The Omnipress plugin for WordPress permits authenticated users with Author‑level access to upload SVG files. Because the plugin does not sanitize user‑supplied SVG content nor escape output, these files are stored and served unchanged. A malicious SVG containing injected JavaScript or other executable payload will run in the browser of any user who opens the file, satisfying CWE‑79 and enabling the attacker to execute arbitrary client‑side code, steal session cookies, or deface pages on the site.

All released versions of Omnipress up to and including 1.6.5 are affected. The plugin, distributed under the omnipressteam:Omnipress vendor label, contains the flaw in its core REST API upload handling routines. Administrators or site editors with Author role should treat any current or past SVG uploads as potentially malicious and review or remove them.

The CVSS score of 6.4 classifies the vulnerability as medium severity. The EPSS score falls below 1%, indicating that the likelihood of exploitation observed in the wild is very low today, and it is not listed in the CISA KEV catalog. Nonetheless, because the attacker needs only Author‑level authentication, an attacker could easily exploit it. The attack vector involves an author logging in, uploading a crafted SVG via the plugin’s file‑upload endpoint, and then any site visitor who opens that file will suffer cross‑site scripting. The path is purely through the web interface, with no requirement for network‑level access.