CVE-2024-9071: 
WordPress vulnerability analysis and mitigation

The Easy Demo Importer plugin for WordPress (versions up to 1.1.2) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-9071) that affects SVG file uploads. The vulnerability was discovered by Francesco Carlucci and disclosed on October 3, 2024. This security issue affects the plugin's file upload functionality, specifically when handling SVG files (NVD).

The vulnerability stems from insufficient input sanitization and output escaping when handling SVG file uploads. This security flaw has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected SVG file, potentially compromising the security of the website and its users (NVD).

The vulnerability has been patched in version 1.1.3 of the Easy Demo Importer plugin. The update includes SVG file sanitization to prevent malicious content uploads, file size validation for SVG uploads with customizable size limits, and improved MIME type detection for SVG files. Users are strongly advised to update to version 1.1.3 or later (WordPress Plugin).