The Enable SVG, WebP, and ICO Upload WordPress plugin contains a stored cross‑site scripting flaw that arises from insufficient sanitization of SVG file uploads. Authenticated users with Author privileges or higher can embed malicious scripts into an SVG file, and the script will run in the browsers of any visitor who opens the SVG. This enables attackers to execute arbitrary code in the context of site visitors, potentially leading to session hijacking, credential theft, or defacement of site content.

All WordPress sites that have installed versions of the Enable SVG, WebP, and ICO Upload plugin up to and including 1.1.2 are affected. Any site using this plugin in that version range and that permits Author‑level users to upload SVG files is vulnerable.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low likelihood of exploitation so far. It is not listed in the CISA KEV catalog. Exploitation requires only an existing Author‑level account and the ability to upload a crafted SVG file, making the attack fairly straightforward once the plugin is present and the user can upload files.