CVE-2023-6708

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping, even when the 'Sanitize SVG while uploading' feature is enabled. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that successful exploitation of this vulnerability requires the administrator to allow author-level users to upload SVG files. As of 2.5.6, SVG sanitization can still be bypassed by supplying a content-type other than image/svg+xml.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-67098.8Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-67105.4A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parametCVE-2023-67117.5Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially CVE-2023-67176.0A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as AsseCVE-2023-67187.5An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to CVE-2023-67196.1An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable appliCVE-2023-67205.4An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on tCVE-2023-67217.5An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the CVE-2023-67227.5A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resultingCVE-2023-67239.8An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforCVE-2023-67248.8Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company HearingCVE-2023-67255.5An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND