Stored XSS via SVG Upload in Enable SVG, WebP, and ICO Upload WordPress Plugin

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Enable SVG, WebP, and ICO Upload WordPress plugin versions 1.1.3 to 1.1.5. It occurs because the plugin fails to sanitize uploaded SVG files that are not detected as SVG content but are still stored and served as SVG images. Attackers with author role or higher can upload malicious SVG files containing scripts, which execute when viewed by other users.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the 'Enable SVG, WebP, and ICO Upload' plugin. If it is between 1.1.3 and 1.1.5, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the plugin version.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to inject and execute malicious scripts in the context of a user's browser session. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of the user. Users with author role or higher can upload the malicious files, and all users viewing the affected SVG images are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face fines or penalties for failing to protect user data adequately.

Useful 0 Not Useful 0

Mitigation Strategies

Update the 'Enable SVG, WebP, and ICO Upload' plugin to version 1.1.6 or later immediately to patch the vulnerability. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Useful 0 Not Useful 0