CVE-2024-11093: 
WordPress vulnerability analysis and mitigation

The SG Helper plugin for WordPress (version 1.0) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-11093) discovered and disclosed on December 3, 2024. The vulnerability affects the plugin's SVG file upload functionality and has been assigned a CVSS v3.1 base score of 5.5 (Medium) (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the SVG file upload functionality. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, high privileges required, no user interaction needed, and potential for both confidentiality and integrity impacts (NVD).

When exploited, this vulnerability allows authenticated attackers with Administrator-level access to inject arbitrary web scripts through SVG file uploads. These malicious scripts will execute whenever a user accesses the affected SVG file, potentially compromising the security of site visitors (NVD).

The plugin has been closed as of December 2, 2024, due to security issues. Users are advised to remove the plugin from their WordPress installations immediately as it is no longer available for download (WordPress).