CVE-2024-4759

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Mime Types Extended	<= 0.11
mime_types_extended	mime_types_extended	<= 0.11

References

https://wpscan.com/vulnerability/1c7547fa-539a-4890-a94d-c57b3d025507/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1c7547fa-539a-4890-a94d-c57b3d025507/Exploit, Third Party Advisory

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-475908.8An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this CVE-2024-475925.3SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs CVE-2024-475934.3SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise CVE-2024-475945.4SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability i CVE-2024-475957.1An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful explo CVE-2024-475967.5GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_CVE-2024-475979.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_sam CVE-2024-475989.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_me CVE-2024-475997.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in CVE-2024-47606.3A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U mic CVE-2024-476009.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_chann CVE-2024-476017.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in