CVE-2024-10222

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10222
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10222.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10222
Published
2025-02-21T14:15:30.680Z
Modified
2026-03-14T12:23:54.710387Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. By default, this can only be exploited by administrators, but the ability to upload SVG files can be extended to authors.

References

Affected packages

Git / github.com/benbodhi/svg-support

Affected ranges

Type
GIT
Repo
https://github.com/benbodhi/svg-support
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eee3e13b650511c9cc9ee0746be485d031c7c072

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2.5.11"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10222.json"