Add SVG Support for Media Uploader WordPress Plugin Stored Cross-Site Scripting Vulnerability
Vulnerability
A stored cross-site scripting vulnerability has been identified in the Add SVG Support for Media Uploader WordPress plugin, versions through 1.0.5. The issue arises because the plugin fails to properly sanitize uploaded SVG files, allowing users with at least Author roles to upload malicious SVGs containing XSS payloads.
Impact
Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files with embedded XSS payloads are executed when the SVGs are viewed.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
1.7exploitability
6.3remediation
0.0relevance
0.0threat
6.4urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.