CVE-2024-9376
Description
The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Kata Plus plugin for WordPress up to 1.4.7 allows stored XSS via SVG uploads, exploited by authenticated attackers with Author-level access.
The vulnerability is a stored cross-site scripting (XSS) flaw in the Kata Plus – Addons for Elementor plugin for WordPress. Affecting versions up to and including 1.4.7, the plugin fails to properly sanitize SVG file uploads, allowing malicious scripts to be embedded in uploaded SVG files due to insufficient input sanitization and output escaping.
Exploitation requires authenticated access with at least Author-level permissions. An attacker can upload a crafted SVG file containing JavaScript code as part of the file upload functionality provided by the plugin. The script then executes whenever any user accesses the uploaded SVG file, such as when viewing it in a browser.
Successful exploitation allows the attacker to inject arbitrary web scripts in the context of the affected website, leading to potential theft of sensitive information, session hijacking, or defacement.
The vendor has addressed this issue in later versions of the plugin, as indicated by security fixes in version 1.5.6 and subsequent releases [1]. Users are strongly advised to update to the latest available version.
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.