VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 25, 2022· Updated Jun 17, 2026

CVE-2022-2299

CVE-2022-2299

Description

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Allow Svg Files Project/Allow Svg Files2 versions
    cpe:2.3:a:allow_svg_files_project:allow_svg_files:1.0:*:*:*:*:wordpress:*:*+ 1 more
    • cpe:2.3:a:allow_svg_files_project:allow_svg_files:1.0:*:*:*:*:wordpress:*:*
    • cpe:2.3:a:allow_svg_files_project:allow_svg_files:1.1:*:*:*:*:wordpress:*:*
  • WordPress/Allow SVG Filesllm-fuzzy
    Range: <=1.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.