CVE-2022-1091

6.1 mediumEPSS 1.2%

Medium (6.1) in 10up safe svg. EPSS 1.2% chance of exploitation in the next 30 days.

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-04-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

10up:safe_svg

References

https://github.com/10up/safe-svg/pull/28
https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3
https://github.com/10up/safe-svg/pull/28
https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3

Check your stack JSON