CVE-2022-1091

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10924.3The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowi CVE-2022-10934.8The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowin CVE-2022-10944.8The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2022-10954.8The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privil CVE-2022-10968.8Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted H CVE-2022-10976.5<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading CVE-2022-10987.8Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrec CVE-2022-10994.3Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior CVE-2022-11004.3A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 1 CVE-2022-11019.8A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unkno CVE-2022-11026.1A vulnerability classified as problematic has been found in SourceCodester Royale Event Management System 1.0. Affected is an unknown functi CVE-2022-11038.8The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, wh