CVE-2023-6708

The SVG Support plugin for WordPress offers a feature to upload SVG files with automatic sanitization [1]. However, CVE-2023-6708 reveals that the plugin's input sanitization and output escaping are insufficient, even when the "Sanitize SVG while uploading" option is enabled. This stored cross-site scripting vulnerability affects all versions up to and including 2.5.7.

Exploitation requires authenticated access at the author level or higher, and the administrator must allow author-level users to upload SVG files. An attacker can craft a malicious SVG file that bypasses sanitization; specifically, the bypass can be achieved by supplying a content-type other than image/svg+xml. Once uploaded, the script is stored and executed when any user views the infected page.

Successful exploitation allows arbitrary web script injection, which can steal sensitive data, perform actions on behalf of the victim, or deface the site. The impact is moderate due to the prerequisites (author-level access and admin permission), but the stored nature increases the risk.

As of the advisory, no patch is explicitly mentioned for versions after 2.5.7. Users should update to the latest version if available, or restrict SVG upload capabilities to trusted users only.