The Bit File Manager plugin for WordPress is vulnerable to stored cross‑site scripting through SVG file uploads in all releases up to version 6.7. The flaw stems from insufficient input sanitization and output escaping, enabling authenticated users with Subscriber‑level access or higher to embed malicious JavaScript into an SVG file. When other site visitors open that file, the attacker‑supplied scripts execute in their browsers, potentially allowing the attacker to steal user sessions, deface websites, or redirect users to malicious sites.

WordPress installations running the Bit File Manager plugin version 6.7 or older are affected. The vulnerability exists in the File Manager component provided by bitpressadmin and affects all environments where the plugin is configured to accept SVG uploads.

With a CVSS score of 6.4 the issue is considered a moderate‑severity flaw, and the EPSS score of less than 1 % indicates a low probability of active exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker has authenticated access with Subscriber‑level or higher privileges; the attack vector is therefore an authenticated, authenticated‑file‑upload pathway. Once the malicious SVG is uploaded, any subsequent user who opens the file will be exposed to the embedded script.