WebsiteBaker Stored Cross-Site Scripting Vulnerability via SVG File Upload

A stored cross-site scripting vulnerability has been identified in WebsiteBaker version 2.13.3. This issue allows authenticated users to upload malicious SVG files containing embedded JavaScript. When these crafted SVG files are viewed, the JavaScript executes, leading to persistent cross-site scripting attacks.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files execute embedded JavaScript when accessed, potentially leading to malicious actions being performed on behalf of the user.

Reproduction

To reproduce this vulnerability, log into an account on WebsiteBaker 2.13.3. Navigate to the media section and upload an SVG file containing a script tag with JavaScript, such as one that alerts the document location. After uploading, access the SVG file through the media directory to trigger the JavaScript execution.