CVE-2024-9426
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Published: Nov 13, 2024 / Updated: 7d ago
010
CVSS 6.4EPSS 0.04%Medium
CVE info copied to clipboard
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Timeline
CVE Assignment
NVD published the first details for CVE-2024-9426
Nov 13, 2024 at 2:15 AM
CVSS
A CVSS base score of 6.4 has been assigned.
Nov 13, 2024 at 2:20 AM / nvd
First Article
Feedly found the first article mentioning CVE-2024-9426. See article
Nov 13, 2024 at 2:21 AM / Vulners.com RSS Feed
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Nov 13, 2024 at 2:21 AM
Affected Systems
Wordpress/wordpress
+null more
Attack Patterns
CAPEC-209: XSS Using MIME Type Mismatch
+null more
News
NA - CVE-2024-9426 - The Aqua SVG Sprite plugin for WordPress is...
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and...
CVE-2024-9426
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVE-2024-9426
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG...
CVE-2024-9426
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG...
CVE-2024-9426 | Aqua SVG Sprite Plugin up to 3.0.14 on WordPress SVG File Upload cross site scripting
A vulnerability was found in Aqua SVG Sprite Plugin up to 3.0.14 on WordPress. It has been declared as problematic . This vulnerability affects unknown code of the component SVG File Upload Handler . The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-9426 . The attack can be initiated remotely. There is no exploit available.