CVE-2022-1755 SVG Support < 2.5 - Author+ Stored Cross-Site Scripting

Q: What is CVE-2022-1755?

CVE-2022-1755 is a medium-severity cross-site scripting vulnerability in Unknown SVG Support, published on 26 Sep 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Q: Is CVE-2022-1755 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1755 exists.

Q: How do I fix CVE-2022-1755?

No fix has been published for CVE-2022-1755 yet. Limit exposure of the affected software until one is available.

Medium 5.4 Published 26 Sep 2022 Updated 21 May 2025

Authors can execute arbitrary JavaScript via malicious SVG URLs in the SVG Support WordPress plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-1755?

CVE-2022-1755 is a medium-severity cross-site scripting vulnerability in Unknown SVG Support, published on 26 Sep 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks

Weakness: CWE-79

Which versions are affected by CVE-2022-1755?

It affects 1 product.

Products include Benbodhi Svg Support.

How do I fix CVE-2022-1755?

No fix has been published for CVE-2022-1755 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-1755 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1755 exists.

Sources

Also known as GHSA-vwr7-qp65-68hx.