CVE-2024-2324

The FileOrganizer plugin for WordPress through version 1.0.6 contains a stored cross-site scripting vulnerability allowing attackers to upload malicious SVG files due to inadequate sanitization and escaping of input. In the free version, only administrators can exploit this flaw to inject arbitrary scripts that execute when other users view affected pages, while the pro version permits the same attack by administrators and potentially by lower-privileged users including subscribers if that functionality is enabled. The vulnerability affects all versions up to and including 1.0.6 and is resolved in version 1.0.7 or later.

Based on public CVE data (MITRE/NVD).