CVE-2023-5458

5.4 mediumEPSS 0.5%

Medium (5.4) in ashik cits support svg\, webp media and ttf\,otf file upload. EPSS 0.5% chance of exploitation in the next 30 days.

The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ashik:cits_support_svg\,_webp_media_and_ttf\,otf_file_upload

References

https://wpscan.com/vulnerability/47d15f1c-b9ca-494d-be8f-63c30e92f9b8
https://wpscan.com/vulnerability/47d15f1c-b9ca-494d-be8f-63c30e92f9b8

Check your stack JSON