The vulnerability is a stored cross‑site scripting flaw that allows an attacker with Author‑level permissions to upload an SVG file containing malicious scripts; once stored, any user who accesses the file will have the script executed in their browser, potentially compromising credentials, session data, or enabling further attacks. The flaw stems from insufficient sanitization of SVG content during upload, leading to arbitrary JavaScript injection, and corresponds to CWE‑79.

Any WordPress site that has installed the URL Image Importer plugin version 1.0.7 or earlier is affected. Any environment where the plugin is present can be exploited if an authenticated Author user exists and can upload SVG files.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% shows a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Nonetheless, authenticated authors can inject scripts that will run for all users who view the SVG, allowing attackers to steal session information, deface content, or launch further web‑based attacks.