CVE-2021-24686

The SVG Support plugin versions before 2.3.20 failed to properly sanitize the "CSS Class to target" setting when displaying it within an HTML attribute, creating a cross-site scripting vulnerability that could be exploited by administrators and other high-privilege users to inject malicious code even in environments where unfiltered HTML capability was restricted.

Based on public CVE data (MITRE/NVD).