CVE-2024-4759
Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload
MEDIUM 5.5EPSS 0.4%
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Affected
- Mime Types Extended
- CVSS v3.1 CNA
- 5.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - EPSS
- 0.35% chance of exploitation in the next 30 days, 27th percentile
- Published
- 2024-06-25
- Updated
- 2024-08-01