The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Svg Block Plugin | — | Update svg-block plugin to version 1.1.20, or a newer patched version | May 15, 2025 | Jun 22, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub