The Ayyash Studio plugin for WordPress contains a stored cross‑site scripting flaw where authenticated users with Author-level or higher access can upload SVG files that are not properly sanitized or escaped. Malicious JavaScript can be embedded inside these SVG files, which the plugin stores and then serves to any user who opens the file. The injected script runs in the victim’s browser when the file is viewed, exposing the site to client‑side code execution.

All installations of the Ayyash Studio – The kick‑start kit plugin for WordPress up to and including version 1.0.3 are affected. The plugin is distributed by themerox and installed on WordPress sites that grant author‑level access for content upload.

The CVSS score of 6.4 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently rare. The flaw is not listed in the CISA KEV catalog. Attacking this vulnerability requires an authenticated account with Author or higher privileges, after which an attacker can upload a malicious SVG. Once stored, the payload executes automatically for any user who accesses the file, creating a persistent client‑side attack vector.