The Your Simple SVG Support plugin allows authenticated users with Author or higher privileges to upload SVG files that are stored without proper sanitization or escaping. The uploaded SVG can contain malicious scripts that are executed when any user accesses the image, leading to theft of session cookies, defacement, or other client‑side attacks. The vulnerability aligns with CWE‑79, a classic reflected/ stored XSS weakness. The primary impact is the potential to run arbitrary JavaScript in the context of any browser that views the file, compromising user data and trust.

The flaw exists in all releases of the Your Simple SVG Support WordPress plugin up to and including version 1.0.1. WordPress sites that have this plugin installed and allow author‑level users to upload SVG files are affected. No specific server or OS versions are mentioned.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw requires only Author‑level access, many sites with multiple contributors could be at risk. Attackers can exploit the weakness by simply uploading a crafted SVG; no additional conditions are needed beyond the stated privileges.