The Easy SVG Support plugin stores malicious SVG files uploaded by users with Author-level access, allowing the injection of arbitrary JavaScript that runs whenever a victim views the SVG. This is a classic stored XSS flaw (CWE‑79) that can lead to cookie theft, session hijacking, or the execution of further malicious payloads inside the victim’s browser.

All releases of the Easy SVG Support plugin for WordPress up to and including version 4.0 are affected. No other products or versions are listed, so WordPress sites that employ this plugin in any of those versions are vulnerable.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of < 1 % shows a very low likelihood of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no known public exploits. However, since an attacker must be authenticated with Author or higher privileges, the attack vector is limited to internal site editors or administrators using the plugin’s upload interface.