Blaze Demo Importer
Monthly
Stored cross-site scripting in the Blaze Demo Importer WordPress plugin before 1.0.17 allows authenticated users holding the Author role or higher to upload crafted SVG files that execute arbitrary JavaScript in the browser of any user who later opens or previews them. The plugin both skips sanitization of uploaded SVGs and unconditionally registers the SVG MIME type with the WordPress media library, bypassing WordPress's default block on SVG uploads. Publicly available exploit code exists and the issue carries a moderate CVSS 6.8; because the payload is passive-stored and only fires when a second user (typically an administrator) opens the file, risk is concentrated on multi-author sites that grant Author accounts to untrusted or self-registered users, while sites with only trusted staff face materially lower exposure.
Stored cross-site scripting in the Blaze Demo Importer WordPress plugin before 1.0.17 allows authenticated users holding the Author role or higher to upload crafted SVG files that execute arbitrary JavaScript in the browser of any user who later opens or previews them. The plugin both skips sanitization of uploaded SVGs and unconditionally registers the SVG MIME type with the WordPress media library, bypassing WordPress's default block on SVG uploads. Publicly available exploit code exists and the issue carries a moderate CVSS 6.8; because the payload is passive-stored and only fires when a second user (typically an administrator) opens the file, risk is concentrated on multi-author sites that grant Author accounts to untrusted or self-registered users, while sites with only trusted staff face materially lower exposure.