CVE-2024-11184: 
PHP vulnerability analysis and mitigation

The wp-enable-svg WordPress plugin through version 0.7 contains a security vulnerability that fails to properly sanitize SVG files during upload. This vulnerability was discovered and publicly disclosed on December 11, 2024, affecting users with author-level permissions and above (WPScan, NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, identified as CWE-79. It has been assigned a CVSS score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The core issue lies in the plugin's failure to implement proper sanitization measures for uploaded SVG files, which can contain embedded scripts (WPScan).

When exploited, this vulnerability allows authenticated users with author-level permissions or higher to upload SVG files containing malicious JavaScript code. When other users browse to the URL of the uploaded SVG file, the malicious JavaScript code executes in their browser context (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the wp-enable-svg plugin should consider disabling the plugin or implementing additional security controls to restrict SVG file uploads until a patch is released (WPScan).