CVE-2022-23638 MEDIUM

CVE-2022-23638: Cross-site Scripting in svg-sanitizer

Vendor Darylldoyle

Product svg-sanitizer

Weakness CWE-79 · XSS

Published February 14, 2022

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

6.2/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.

Key dates

02Disclosure timeline

February 14, 2022 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-23638 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-32300 WordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-30836 WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability CVE-2025-68889 WordPress Pinpoll plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-58260 WordPress Highlight and Share – Social Text and Image Sharing plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2023-38491 Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files