Skip to content
Sign in
4.8 Medium

CVE-2024-8378 The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call…

Description

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.

Affected products and versions

Product Affected versions Fixed in
Safe SVG 2.2 earliest → < 2.2.6 2.2.6
safe_svg 2.2 earliest → < 2.2.6 2.2.6

Other CVEs of Safe SVG

The 2 CVEs of Safe SVG →
CVE-2022-1091 The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the… Not rated
Track this CVE