CVE-2024-11644: 
WordPress vulnerability analysis and mitigation

The WP-SVG WordPress plugin through version 0.9 contains a stored Cross-Site Scripting (XSS) vulnerability that affects users with contributor role and above. The vulnerability was discovered and publicly published on December 6, 2024, and was assigned CVE-2024-11644 (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes before they are output back in pages or posts where the shortcode is embedded. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

This vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. When successfully exploited, it could enable attackers to inject malicious JavaScript code that executes in visitors' browsers when viewing affected pages (WPScan).

A proof of concept exists demonstrating the vulnerability can be exploited by adding a malicious payload in the SVG shortcode attributes. The exploit involves using the onmouseover event to trigger JavaScript code execution when users interact with the rendered SVG image (WPScan).

Currently, there is no known fix available for this vulnerability in the WP-SVG plugin (WPScan).