WordPress GDPR-Extensions Consent Manager <=1.0.0 Authenticated Stored XSS via SVG Upload (CVE-2024-9072)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: GDPR-Extensions-com - Consent Manager <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 2. Vulnerability Description: - Describes a Cross-Site Scripting (XSS) vulnerability in all versions <= 1.0.0 of the GDPR-Extensions-com - Consent Manager plugin, caused by improper input handling and lack of proper output escaping. - The vulnerability allows attackers with Author-level or higher privileges to inject arbitrary scripts by uploading an SVG file. When a user accesses the file, the injected script will be executed. 3. Vulnerability Rating: - CVSS Score: 6.4 (Medium) - CVE ID: CVE-2024-9072 4. Public Release Date: October 9, 2024 5. Last Updated: October 10, 2024 6. Researcher: Francesco Carlucci 7. Affected Versions: <= 1.0.0 8. Fix Status: No known fix available. 9. Recommendations: - Review the vulnerability details and take appropriate remediation actions based on your organization’s risk tolerance. - It is best to uninstall the affected software and find a suitable alternative. 10. Copyright and Licensing Information: - Copyright and licensing information provided by Defiant Inc. and MITRE Corporation. 11. Wordfence Intelligence: - Offers free access to a WordPress vulnerability database and API integration, along with free Webhook integration to stay informed about the latest vulnerabilities. 12. Additional Information: - Provides links to other Wordfence products and services, such as Wordfence Free, Wordfence Premium, Wordfence Care, etc. This information helps users understand the details of the vulnerability and take appropriate security measures to protect their websites.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress GDPR-Extensions Consent Manager <=1.0.0 Authenticated Stored XSS via SVG Upload (CVE-2024-9072)

More from this source