Vulnerability DatabaseCVE-2024-4270

CVE-2024-4270:
WordPress vulnerability analysis and mitigation

Overview

The SVGMagic WordPress plugin through version 1.1 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-4270. The vulnerability was discovered by Rayhan Ramdhany Hanaputra and publicly disclosed on May 24, 2024. The issue affects the plugin's SVG file handling functionality, specifically impacting installations of SVGMagic up to and including version 1.1 (WPScan).

Technical details

The vulnerability stems from inadequate sanitization of SVG file contents in the plugin. The security flaw has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

Impact

When exploited, this vulnerability allows users with author-level privileges or higher to upload SVG files containing malicious JavaScript code, which can then execute in users' browsers when the SVG is accessed. This creates a stored XSS condition that could potentially affect any user viewing the compromised SVG file (WPScan).

Mitigation and workarounds

Currently, there is no known fix available for this vulnerability. Site administrators using the SVGMagic plugin should consider either removing the plugin or implementing additional security controls to restrict SVG file uploads (WPScan).