CVE-2024-7301 is a stored cross-site scripting vulnerability in the nickboss Iptanus File Upload WordPress plugin. The flaw exists because the plugin does not properly sanitize or escape SVG file uploads, enabling unauthenticated attackers to embed arbitrary scripts. These scripts execute in the context of users viewing the SVG files, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 4.24.8 and has a CVSS 3.1 base score of 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity.

An attacker can exploit this vulnerability to inject and execute arbitrary JavaScript in the browsers of users who access the malicious SVG files uploaded via the vulnerable plugin. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side impacts. The vulnerability does not affect availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling SVG uploads or restricting file upload capabilities to trusted users only. Monitoring for suspicious SVG files and removing untrusted uploads may reduce risk. Avoid accessing SVG files uploaded by untrusted sources.