CVE-2023-28426

The Safe SVG plugin before version 2.1.0 contains a cross-site scripting vulnerability that could enable attackers to embed malicious scripts into SVG files, leading to code execution on visitor browsers. A researcher named Cyxow identified and disclosed this flaw, which permits injection of harmful payloads including redirects, ads, and arbitrary HTML content. The vulnerability was resolved in version 2.1.0, and users should upgrade to this version or later to protect their sites.

Based on public CVE data (MITRE/NVD).