AVIF Uploader – Upload, Display and Fix AVIF Images
AVIF Uploader – Upload, Display and Fix AVIF Images has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for AVIF Uploader – Upload, Display and Fix AVIF Images has a vendor fix available, so running the current release closes it.
All of these findings were reported by Francesco Carlucci. AVIF Uploader – Upload, Display and Fix AVIF Images is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-9060AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Read the full analysisVulnerability Records

AVIF Uploader – Upload, Display and Fix AVIF Images
Author
GrandPlugins
WordPress has handled AVIF since 6.5, but plenty of sites still cannot upload one at all, or upload it and then find the thumbnails never generate and the image reports the wrong dimensions. This plugin fixes that. It first tells you whether your server can process AVIF, then repairs the places WordPress gives up: the upload filter, the width and height metadata, sub-size generation, and the downscaled copy of large images. It does not convert or compress anything. Turning an existing library of JPEGs into AVIF is a different job – see WP Image Converter below. Before you install: AVIF handling depends on your server. If neither GD nor Imagick on your host is built with AVIF support, no plugin can add it. The Status screen tells you exactly where you stand, so check that first. Features Check whether your server can actually handle AVIF, before anything else. Allow AVIF images to be uploaded. Fix the wrong width and height WordPress records for AVIF files. Fix AVIF sub-size (thumbnail) generation. Fix the downscaled copy WordPress makes of large AVIF images. Choose which image library and quality setting to use. For the detail on the WordPress issues this works around: How to upload AVIF images in WordPress More Plugins for Working With Media If you are handling images at any volume, these are the ones our AVIF users reach for most. WP Watermark Images — watermark images in bulk, on upload, or per WooCommerce order. WP Image Converter & Optimizer — convert a whole library between png, jpg, gif, webp and avif. No quota, no third-party service. WP PDF Password Protect — password-protect the PDFs in your media library. WP Watermark PDF — stamp PDFs the same way you stamp images. Image Sizes Controller — see every image size your theme and plugins register, and switch off the ones you never use. WP GIF Editor — resize, crop and optimise animated GIFs inside WordPress. WP Large Images Uploader — upload very large images without hitting server limits. WP Image Magnifier and Lightbox — zoom on hover and a lightbox, without a page builder. If You Run WooCommerce Coming Soon Products — hide or tease WooCommerce products before they launch. Quick View and Buy Now — a product preview and a one-click buy button. Paddle Checkout — take payments through Paddle, with subscriptions. Browse everything
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C