Source evidence

WP Toolkit detects security issues

Enable SVG, WebP, and ICO Upload · support · 2023-06-12T14:13:00+00:00

Enable SVG, WebP, and ICO Upload plugin evidence original source source API

mixedsentiment

highseverity

0.89relevance

1replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

6 / 29 rows with source links

20.7% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

23 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

spiralofhope resolved

Enable SVG, WebP & ICO Upload plugin <= 1.0.3 – Authenticated Arbitrary File Upload Enable SVG, WebP & ICO Upload plugin <= 1.0.3 – Authenticated Stored Cross-Site Scripting (XSS) vulnerability https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upload/wordpress-enable-svg-webp-ico-upload-plugin-1-0-1-authenticated-arbitrary-file-upload-vulnerability?_a_id=110 https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upload/wordpress-enable-svg-webp-ico-upload-plugin-1-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability?_a_id=110 This topic was modified 3 years ago by spiralofhope . Reason: clarity This topic was modified 3 years ago by spiralofhope . Indeed, WP Scan also detects the same vulnerability: https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de And Wordfence as well, of course: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/enable-svg-webp-ico-upload/enable-svg-webp-ico-upload-103-authenticated-author-stored-cross-site-scripting-via-svg At the time of writing, a full disclosure about the vulnerability was not yet publicly shown on the assigned vulnerability numbered CVE-2023-2143 , but it will be soon. Allegedly, the author of this plugin was contacted back in April 2023 to fix the vulnerability. These days, all SVGs ought to be properly sanitized before allowing them to be user-uploaded (as the SafeSVG plugin already does), not merely ‘enabling’ the Media Library to upload SVG files… This reply was modified 3 years ago by Gwyneth Llewelyn . Reason: Added a few more tags

Commercial Context

Opportunity

content publishing operations

Image publishing workflow assurance for keeping publishing, media, and editorial handoffs consistent

Buyer: publishers, content teams, and agencies

Wedge: check image publishing, media, metadata, and editorial handoffs before content goes live

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: WP Toolkit detects security issues: users show security, bugs, performance pain that may indicate a product gap.

Evidence quote: WP Toolkit detects security issues Enable SVG, WebP & ICO Upload plugin <= 1.0.3 – Authenticated Arbitrary File Upload Enable SVG, WebP & ICO Upload plugin <= 1.0.3 – Authenticated Stored Cross-Site Scripting (XSS) vulnerability https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upload/wordpress-enable-svg-webp-ico-upload-plugin-1-0-1-authenti

Affected feature: security

security bugs performance support

Plugin

API

Enable SVG, WebP, and ICO Upload

10.0K active installs · 86.3K downloads · rating 92.0

ico image serve images svg webp

Comments

1 shown

Gwyneth Llewelyn 2023-07-05T19:31:00+00:00

Indeed, WP Scan also detects the same vulnerability: https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de And Wordfence as well, of course: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/enable-svg-webp-ico-upload/enable-svg-webp-ico-upload-103-authenticated-author-stored-cross-site-scripting-via-svg At the time of writing, a full disclosure about the vulnerability was not yet publicly shown on the assigned vulnerability numbered CVE-2023-2143 , but it will be soon. Allegedly, the author of this plugin was contacted back in April 2023 to fix the vulnerability. These days, all SVGs ought to be properly sanitized before allowing them to be user-uploaded (as the SafeSVG plugin already does), not merely ‘enabling’ the Media Library to upload SVG files… This reply was modified 3 years ago by Gwyneth Llewelyn . Reason: Added a few more tags