CVE-2024-7304: 
WordPress vulnerability analysis and mitigation

The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2024-7304) via SVG File uploads in versions up to and including 5.0.12. The vulnerability was discovered and reported by Wordfence, with the disclosure date being August 27, 2024 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's file upload functionality. This security flaw allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts through SVG file uploads. The scripts will execute whenever a user accesses the affected SVG file. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers to execute arbitrary web scripts in the context of users viewing the compromised SVG files. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser session (NVD).

The vulnerability has been patched in version 5.0.13 of the Ninja Tables plugin. Users are strongly advised to update to this version or later to protect against potential exploitation. The fix addresses the input sanitization and output escaping issues related to SVG file uploads (WordPress Plugin).