The vulnerability allows an authenticated user with Author privileges to upload an SVG file that includes malicious JavaScript. When such a file is served, the script executes within the context of any visitor who accesses the page, enabling the attacker to steal credentials, hijack sessions or tamper with page content. The weakness is a classic stored XSS flaw—CWE-79—where insufficient sanitisation of user input and lack of output escaping give the attacker persistent access to the site’s front‑end.

WordPress installations using the "Advanced Accordion Gutenberg Block" plugin from the SpiderDevs vendor, any version up to and including 5.0.2. If multiple sites share a common WordPress instance, every instance running one of these plugin versions is potentially vulnerable.

The CVSS score of 6.4 indicates moderate severity, but the risk is amplified by the fact that any attacker with Author or higher privileges can exploit it. The EPSS score of less than 1% suggests that the likelihood of a publicly documented exploit is low at present, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be local via authenticated uploads, which can lead to remote code execution in browsers that view the malicious SVG file. Official remediation is yet to be published, thus the vendor’s patch or a future update is the primary solution.