The vulnerability allows an authenticated attacker with author or higher privileges to upload an SVG file that contains malicious script. When a user later views that SVG on the website, the injected script runs in the visitor’s browser, giving the attacker potential to hijack sessions, steal credentials, deface the site, or perform other client‑side attacks. The flaw arises from insufficient input sanitization and output escaping, resulting in stored cross‑site scripting that is delivered to all users who view the file.

WordPress sites running the AI Content Pipelines plugin 1.6 or earlier, which is managed by Adamwillhoeft and distributed as the Content Engine + Analytics add‑on. All supported WordPress versions that can host this plugin are affected, with no sub‑version details beyond the 1.6 cutoff.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is listed as < 1 %, suggesting a low probability of real‑world exploitation at this time. The flaw is not cataloged in CISA’s KEV list. Attackers would need author‑level authentication on the site and then upload an SVG file through the plugin’s interface; the stored script is later delivered to all users who view the file, typically via a normal page request. Pre‑conditions include user authentication and the plugin’s upload feature being enabled.