Blaze Demo Importer CVE-2026-106933

Exploitation requires an authenticated WordPress account with the Author role or higher on a site running Blaze Demo Importer before 1.0.17, because the plugin fails to sanitize uploaded SVG files and unconditionally registers the SVG MIME type for the media library (normally blocked by default WordPress upload filtering). The payload is passive-stored: it does not fire at upload time but only when a second user (e.g. an administrator) subsequently opens or previews the malicious SVG, so the UI:R user-interaction step is a genuine limiting factor. Risk is therefore concentrated on multi-author sites that grant Author accounts to untrusted or self-registered users; sites where all authors are trusted staff face materially lower exposure.

This is a stored cross-site scripting flaw (CWE-79) in the Blaze Demo Importer WordPress plugin, carrying a moderate CVSS 6.8. The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) and the description conflict in two important ways and should be verified. First, the vector states PR:H (high privilege) while the description says the attacker only needs the Author role 'or higher' - Author is a relatively low-trust, often self-registered or contributor-tier role, which maps more accurately to PR:L; this makes the privilege barrier lower than the vector implies. Second, the C:H/I:H/A:H impact is aggressive for a browser-executed XSS confined to script context; stored XSS impact is typically partial (C:L/I:L) unless the payload is chained to a full admin-account or site takeover. Exploitation requires an authenticated foothold (PR is non-None) plus user interaction (UI:R) - a victim must open the malicious SVG - so this is not a wormable, unauthenticated internet-facing bug. Publicly available exploit code exists (reported by WPScan), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation. Net assessment: a real but second-tier priority - patch promptly on sites that allow untrusted Author-level accounts, but it is not a drop-everything emergency on sites where all authors are trusted staff.

An attacker who holds (or obtains via self-registration/social engineering) an Author-level WordPress account uploads a crafted SVG file whose embedded JavaScript the plugin stores and serves without sanitization. When an administrator or other user later opens or previews that SVG in the media library, the script executes in their browser session, enabling session/cookie theft or actions in the victim's authenticated context. A public proof-of-concept from WPScan exists, and the low attack complexity (AC:L) makes the upload step trivial once an account is held.