Svg Support
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:svg_support:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Svg Support (cfc7897a-689e-5129-ba3b-1d128166129d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13340 |
vulnerable | 2026-09-16 04:32:50.154058 |
SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
Published: 2026-08-03T06:00:11.984Z
Updated: 2026-08-03T17:04:22.325Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1755 |
vulnerable | 2026-06-08 05:39:13.861316 |
SVG Support < 2.5 - Author+ Stored Cross-Site Scripting
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
Published: 2022-09-26T12:35:31.000Z
Updated: 2025-05-21T19:21:54.712Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.