CVE-2021-24386: 
WordPress vulnerability analysis and mitigation

The WP SVG Images plugin for WordPress, versions prior to 3.4, contained a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24386. The vulnerability allowed authenticated users with author-level privileges or higher to upload malicious SVG files, potentially enabling XSS attacks when other users accessed these files directly (WPScan).

The vulnerability stemmed from insufficient sanitization of SVG file uploads in the plugin. Users with author-level privileges or higher could exploit this by uploading SVG files containing malicious scripts. The vulnerability was assigned a CVSS score of 5.4 (medium) and was classified under CWE-79 (WPScan).

If exploited, this vulnerability could allow attackers to perform cross-site scripting attacks by inducing other users to access maliciously crafted SVG files directly. The impact was particularly significant as it could affect any user accessing the compromised files, potentially leading to session hijacking or other client-side attacks (WPScan).

The vulnerability required an authenticated user with author-level privileges or higher to upload a malicious SVG file. The exploit could be triggered when other users accessed the uploaded file directly through its URL (e.g., https://example.com/wp-content/uploads/2021/06/xss.svg) (WPScan).

The vulnerability was patched in version 3.4 of the WP SVG Images plugin. The fix restricted SVG upload capabilities to editors and administrators by default, with an optional setting to allow authors to upload SVG files. The plugin's description was also updated to include a security warning about the intended use of such content (WPScan).