Medium severity6.4NVD Advisory· Published Jun 21, 2024· Updated Apr 8, 2026
CVE-2024-5945
CVE-2024-5945
Description
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A bypass to the patch in version 4.3 was discovered and fixed completely in version 4.4.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- plugins.trac.wordpress.org/changeset/3105276/nvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/389d96e9-1fad-49a6-89b6-8f7f108d8117nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/wp-svg-images/trunk/wp-svg-images.phpnvdProduct
- plugins.trac.wordpress.org/browser/wp-svg-images/trunk/wp-svg-images.phpnvdProduct
- plugins.trac.wordpress.org/changesetnvd
News mentions
0No linked articles in our index yet.