Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2024-9426: Aqua SVG Sprite plugin: Malicious SVG files can inject code into WordPress sites
CVE-2024-9426 · published 1 year ago
Summary
The Aqua SVG Sprite plugin for WordPress is not properly checking files uploaded to it. This means that malicious users with the right permissions can upload SVG files that can inject code into WordPress sites, potentially harming visitors. Update to the latest version of the plugin to fix this issue.
Original advisory text
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and ou...
The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Nov 2024
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-9426 · NVD
Track software like this
Free during beta