CVE-2024-5945: 
WordPress vulnerability analysis and mitigation

The WP SVG Images plugin for WordPress (CVE-2024-5945) contains a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 4.2. The vulnerability was discovered and disclosed on June 21, 2024, and affects the plugin's handling of the 'type' parameter (NVD).

The vulnerability stems from insufficient input sanitization in the plugin's handling of the 'type' parameter. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Wordfence has assigned a slightly higher CVSS score of 6.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with Author-level access or higher to bypass SVG sanitization and inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially compromising the security of site visitors (NVD).

The vulnerability requires an authenticated user with Author-level privileges or higher who has permissions to upload sanitized files. The attacker can then exploit the insufficient input sanitization to bypass the SVG sanitization mechanisms (NVD).

Users should update to version 4.3 or later of the WP SVG Images plugin, which contains fixes for this vulnerability. A patch has been released and is available through the WordPress plugin repository (WordPress Patch).