VulnerabilityAnalyzed

CVE-2024-9271

MEDIUM 5.4EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

The Re:WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.31% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: remilia/re\
Source: security@wordfence.com

References

https://plugins.trac.wordpress.org/changeset/3161983/Patch
https://wordpress.org/plugins/rewp/#developersProduct, Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d340b9-6a77-481c-983c-f4774ecff285?source=cveThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.