Input validation vulnerability in WebP & SVG Support 1.4.0

The WebP & SVG Support plugin for WordPress has a security issue that can affect all versions up to 1.4.0. This vulnerability is known as Stored Cross-Site Scripting and it is caused by not properly cleaning and filtering user input. This means that attackers with Author-level or higher access can upload SVG files that contain harmful web code. When a user opens the SVG file, the code will be executed, potentially causing harm.

Detected in:

WebP & SVG Support open vulnerable versions: >= * <= 1.4.0

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

Is this information incorrect? Please leave us a message.