CVE-2024-10584: CWE-434 Unrestricted Upload of File with Dangerous Type in designinvento DirectoryPress – Business Directory And Classified Ad Listing
The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. When DirectoryPress Frontend is installed, this can be exploited by unauthenticated users.
AI Analysis
Technical Summary
CVE-2024-10584 is a vulnerability in the DirectoryPress WordPress plugin that allows stored cross-site scripting through unrestricted upload of SVG files containing malicious scripts. The plugin fails to properly sanitize and escape SVG file content, enabling attackers with author-level privileges to embed executable scripts. When the DirectoryPress Frontend is present, this attack vector extends to unauthenticated users. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and affects all versions up to 3.6.16.
Potential Impact
Successful exploitation allows injection and execution of arbitrary web scripts in the context of the vulnerable website, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires at least author-level privileges unless the DirectoryPress Frontend is installed, which lowers the attack barrier to unauthenticated users.
Mitigation Recommendations
Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict author-level access to trusted users and consider disabling SVG uploads if possible. Review and harden file upload handling policies to mitigate risk.
CVE-2024-10584: CWE-434 Unrestricted Upload of File with Dangerous Type in designinvento DirectoryPress – Business Directory And Classified Ad Listing
Description
The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. When DirectoryPress Frontend is installed, this can be exploited by unauthenticated users.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-10584 is a vulnerability in the DirectoryPress WordPress plugin that allows stored cross-site scripting through unrestricted upload of SVG files containing malicious scripts. The plugin fails to properly sanitize and escape SVG file content, enabling attackers with author-level privileges to embed executable scripts. When the DirectoryPress Frontend is present, this attack vector extends to unauthenticated users. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and affects all versions up to 3.6.16.
Potential Impact
Successful exploitation allows injection and execution of arbitrary web scripts in the context of the vulnerable website, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires at least author-level privileges unless the DirectoryPress Frontend is installed, which lowers the attack barrier to unauthenticated users.
Mitigation Recommendations
Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict author-level access to trusted users and consider disabling SVG uploads if possible. Review and harden file upload handling policies to mitigate risk.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-10-31T13:38:43.331Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6df6b7ef31ef0b59181f
Added to database: 2/25/2026, 9:47:34 PM
Last enriched: 4/9/2026, 11:59:48 AM
Last updated: 4/11/2026, 4:54:25 PM
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.