CVE-2024-8378

PoC —

CVSS 3.1

4.8 medium

EPSS

<1%p24

Published

Nov 7, 2024 (Nov 7, 2024)

Modified

Jun 17, 2026

Description

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.

Vendors: 10up
Products: safe svg
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.