The Z Companion plugin for WordPress allows authenticated users with Author privileges or higher to upload SVG files that are not properly sanitized or escaped. An attacker can inject arbitrary JavaScript into the SVG, which will execute whenever a site visitor views the image. This stored XSS can lead to session hijacking, credential theft, defacement, or silent data exfiltration, compromising the confidentiality, integrity, and availability of the site’s visitors.

This vulnerability affects any WordPress site running Z Companion version 1.1.1 or older, and requires the Royal Shop theme to be installed. The affected product is listed as wpzita:Z Companion under the vendor name wpzita in the WordPress ecosystem.

The CVSS score for this flaw is 6.4, indicating moderate severity. The EPSS score is below 1 %, suggesting the probability of exploitation is very low at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only Author-level credentials—which many sites assign to content creators—the attacker needs only legitimate access rights. Once a malicious SVG is uploaded, any visitor who requests the file will be exposed to the injected script, enabling the attacker to gain further foothold or data from unsuspecting users.