CVE Daily

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only run...

Medium CVSS 4.8

Overview

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.

CWE: N/A Published: 2024-11-07T16:15:18.057
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.8 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags