AVIF Uploader WordPress Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the AVIF Uploader WordPress plugin, affecting versions prior to 1.1.1. The issue arises because the plugin fails to properly sanitize uploaded SVG files. This lack of sanitization could enable users with an Author role to upload malicious SVGs containing XSS payloads.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files with XSS payloads are executed in the context of the user viewing the SVG.

Remediation

Users are advised to update the AVIF Uploader WordPress plugin to version 1.1.1 or later.