Allow SVG WordPress Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Allow SVG WordPress plugin, affecting versions prior to 1.2.0. The issue arises because the plugin does not properly sanitize uploaded SVG files. This lack of sanitation could enable users with an Author role to upload malicious SVGs containing XSS payloads.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files with XSS payloads are executed in the context of the user viewing the SVG.

Remediation

Users are advised to update the Allow SVG WordPress plugin to version 1.2.0 or later.