漏洞详情: CVE-2024-5945

漏洞标题
WP SVG Images <= 4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
来源:NVD
WordPress plugin WP SVG Images 安全漏洞
来源:CNNVD
漏洞描述
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
来源:NVD
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin WP SVG Images 4.2 版本及之前版本存在安全漏洞,该漏洞源于通过 type 参数发现包含跨站脚本漏洞。
来源:CNNVD
NVD 暂无描述信息
来源:神龙机器人
漏洞评分(CVSS)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
来源:NVD
漏洞类别
NVD 暂无漏洞类别信息
来源:NVD
其他
来源:CNNVD
相关链接