PatchTheCVECVE-2024-8378: The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_ha
CVE-2024-8378 is a medium-severity flaw (CVSS 4.8) affecting safe svg. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 74%) |
| CISA exploited list | No |
| Published | 2024-11-07 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-8378?
safe svg: upgrade to 2.2.6. Exact commands for each OS are on this page.
Is CVE-2024-8378 being exploited?
CVE-2024-8378 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-8378 affect?
CVE-2024-8378 affects safe svg. Severity is medium (CVSS 4.8). The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data
How urgent is CVE-2024-8378?
Priority 28/100. Public exploit reference