CVE-2024-11184: The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

January 2, 2025 (updated February 7, 2025)

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

References

github.com/MWDelaney/wp-enable-svg
github.com/advisories/GHSA-j77f-79w9-rghc
nvd.nist.gov/vuln/detail/CVE-2024-11184
wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8

Code Behaviors & Features

Detect and mitigate CVE-2024-11184 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →