blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-4022

MEDIUM 5.4 CVSS 3.1
Published
November 16, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they are uploaded, the plugin defaults to disable sanitization and does not restrict SVG upload to only administrators. This allows authenticated attackers, with author-level privileges and higher, to upload malicious SVG files that can be embedded in posts and pages by higher privileged users. Additionally, the embedded JavaScript is also triggered on visiting the image URL, which allows an attacker to execute malicious code in browsers visiting that URL.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • benbodhi SVG Support — Version 2.5
  • benbodhi SVG Support — Version 2.5.1
  • benbodhi svg_support — From 2.5.0 (including) to 2.5.2 (excluding)

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2776612%40svg-support%2Ftrunk&old=2672900%40svg-support%2Ftrunk&sfp_email=&sfph_mail= Patch, Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4022 Third Party Advisory
  • nvd.nist.gov Official NVD record