CVE-2024-5945 is a stored cross-site scripting vulnerability in the WP SVG Images plugin for WordPress. It arises from insufficient input sanitization of the 'type' parameter, allowing authenticated users with Author-level or higher privileges who can upload sanitized files to inject arbitrary scripts into pages. These scripts execute in the context of users viewing the injected pages. Although version 4.3 included a patch, a bypass was discovered and completely resolved in version 4.4. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, privileges required at the level of an authenticated author, no user interaction required, and impacts confidentiality and integrity with no availability impact.

An attacker with Author-level or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild as of the published date.

Users should upgrade the WP SVG Images plugin to version 4.4 or later, where the vulnerability is fully fixed. Version 4.3 included a patch, but it was bypassed, so only version 4.4 or newer provides complete remediation. Since this is not a cloud service, remediation depends on applying the official plugin update. Patch status is not explicitly stated in the input but can be inferred from the description; however, users should verify the vendor advisory for the latest guidance.