WP Toolkit detects security issues
-
Enable SVG, WebP & ICO Upload plugin <= 1.0.3 – Authenticated Arbitrary File Upload
Enable SVG, WebP & ICO Upload plugin <= 1.0.3 – Authenticated Stored Cross-Site Scripting (XSS) vulnerability
-
Indeed, WP Scan also detects the same vulnerability:
https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de
And Wordfence as well, of course:
At the time of writing, a full disclosure about the vulnerability was not yet publicly shown on the assigned vulnerability numbered CVE-2023-2143, but it will be soon. Allegedly, the author of this plugin was contacted back in April 2023 to fix the vulnerability.
These days, all SVGs ought to be properly sanitized before allowing them to be user-uploaded (as the SafeSVG plugin already does), not merely ‘enabling’ the Media Library to upload SVG files…
- The topic ‘WP Toolkit detects security issues’ is closed to new replies.
