CVE-2024-10016

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-100176.4The PJW Mime Config plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ CVE-2024-100189.8Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.CVE-2024-100196.7A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command inject CVE-2024-10028.8A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function se CVE-2024-100208.1The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35.CVE-2024-100219.8A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unk CVE-2024-100229.8A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the f CVE-2024-100238.8A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code of CVE-2024-100248.8A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some u CVE-2024-100259.1A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plai CVE-2024-100265.3A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address a CVE-2024-100274.8The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high pri