CVE-2021-24386

CVE-2021-24386 describes an unsanitized SVG upload vulnerability in the WP SVG images WordPress plugin prior to version 3.4, affecting kubiq wp_svg_images. This flaw allowed low-privileged users (e.g., authors) to upload malicious SVG files, leading to Cross-Site Scripting (XSS) attacks if another user directly accessed the file. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.