Safe SVG CVE-2026-94077

Requires an authenticated WordPress account with at least Contributor role (PR:L) on a site running Safe SVG <= 2.5.0, since the plugin's SVG upload/sanitization path is the injection point. Exploitation also requires user interaction (UI:R): a higher-privileged user (editor/admin) must view the malicious SVG or the post/media embedding it for the script to fire. Limiting factors: sites that do not grant untrusted users Contributor+ accounts, or that disable SVG uploads, are not realistically exposed; the scope change (S:C) means impact hinges on a privileged victim rendering the payload.

This is a moderate-risk, contributor-privilege stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network vector and low complexity are offset by two meaningful limiters: PR:L requires an authenticated Contributor-or-above account, and UI:R requires a victim (typically an editor or admin) to view the malicious content. The scope change (S:C) reflects that injected script executes in the wp-admin/site origin, potentially against higher-privileged users, which is the realistic escalation path. No EPSS score, KEV listing, or public PoC is provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not a signal of active, widespread abuse. Given Safe SVG's very large install base but the authentication and interaction prerequisites, this is a real but not urgent priority: patch on a normal cadence, prioritized on multi-author sites where untrusted Contributor accounts exist. No signals conflict; the CVSS vector is internally consistent with a contributor stored/SVG-based XSS.

An attacker with a Contributor account uploads or crafts an SVG file that Safe SVG (<= 2.5.0) fails to fully sanitize, embedding JavaScript that survives its sanitization filter. When an administrator or editor previews the media, post, or SVG in wp-admin, the script executes in their authenticated session, enabling session theft or actions on their behalf. No public exploit code is identified at time of analysis.