CVE-2026-94077

MediumCVSS 6.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Safe SVG plugin version 2.5.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Risk Assessment

Risk of malicious script execution in the user's browser, potentially leading to data theft or session hijacking.

Recommendation

Update the Safe SVG plugin to the latest available version that includes the fix.

Other vulnerabilities in Safe SVG

CVE-2026-94672Medium
Safe SVG plugin version 2.5.0 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS