{"id":"GHSA-j77f-79w9-rghc","aliases":["CVE-2024-11184"],"title":"The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded","description":"The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts","severity":"medium","score":4.8,"published":"2025-01-02T06:30:47.000Z","modified":"2025-02-07T21:12:01.867Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mwdelaney/wp-enable-svg","ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.2"}],"type":"ECOSYSTEM"}],"versions":["0.1","0.2"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-11184","https://github.com/MWDelaney/wp-enable-svg","https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8"],"sources":[{"name":"OSV","id":"GHSA-j77f-79w9-rghc","modified":"2025-02-07T21:12:01.867422Z","url":"https://osv.dev/vulnerability/GHSA-j77f-79w9-rghc"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.8}]}