The Viable URL Media Uploader plugin for WordPress contains a stored cross‑site scripting flaw that allows an attacker who can upload SVG files to inject arbitrary JavaScript. The injection is not sanitized or escaped when the SVG file is stored, meaning the malicious code will run automatically whenever a user views that file. This flaw permits attackers with Author‑level or higher access to compromise user sessions, steal cookies, deface content or redirect users to malicious sites, thereby affecting the confidentiality, integrity and availability of the website’s front‑end.

All installations of the Viable URL Media Uploader plugin for WordPress with a version of 1.0.0 or earlier, provided by the vendor ahsangadit. The vulnerability is tied specifically to the plugin’s SVG handling code.

The CVSS score is 6.4, indicating a moderate severity potential. EPSS is not available, but the absence of active exploits in the public domain does not preclude an adversary with author‑level access from leveraging the flaw. The vulnerability is not listed in CISA’s KEV catalog. The attack vector relies on authenticated file upload, meaning an attacker must first have login credentials with at least author permissions. Once authenticated, any SVG file containing malicious payload can be uploaded and stored, making the exploit straightforward and repeatable across the site.