The Amazing service box Addons For WPBakery Page Builder plugin is vulnerable due to insufficient input sanitization and output escaping during SVG file uploads. The flaw allows attackers with Author‑level or higher access to embed malicious scripts inside uploaded SVG files, which are served to any user who opens the file. This leads to a stored Cross‑Site Scripting (XSS) vulnerability (CWE‑79) that can compromise the confidentiality and integrity of users’ data and may be leveraged for session hijacking or other client‑side attacks.

WordPress sites that have installed the Amazing service box Addons For WPBakery Page Builder plugin in any release up to and including version 2.0.0. The vulnerability applies regardless of theme or other plugins, as the flaw exists in the core upload handling of this plugin.

The CVSS score of 6.4 indicates a moderate risk, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. Because the vulnerability requires authenticated access with Author or higher privileges, it is not a purely remote webcast exploit. The plugin is not listed in the CISA KEV catalog, so no public exploit is documented yet. Attackers would need to log into the WordPress admin interface, upload a crafted SVG file, and then entice a user to view the file to trigger the script.