未評価

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation...

CVE-2026-110505 SecPulse初出 15:00

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
CVE	Enable SVG, WebP, and ICO Upload	1.1.6 未満	1.1.6

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web contact@wpscan.com
web nvd.nist.gov
web wpscan.com
web github.com