The WP Extended plugin allows authenticated users with Author level or higher to upload SVG files that are stored without proper sanitization or escaping. This flaw permits the injection of arbitrary JavaScript, which will execute when any user views the SVG file. The weakness is classified as CWE‑79, indicating a failure to protect against cross‑site scripting attacks.

The vulnerability exists in all releases of the WP Extended plugin up to and including version 3.0.15. Users of earlier releases must install the plugin from the WordPress repository or from the vendor’s website, and verify that the plugin version is 3.0.15 or older.

The CVSS score of 6.4 reflects a moderate severity. The EPSS score indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs authenticated access at the Author level or higher and must upload a malicious SVG. Once uploaded, any user who opens the SVG will cause the injected script to run, potentially allowing the attacker to steal session data, deface the site, or further exploit client browsers. Due to the authentication requirement, the potential impact is limited to sites with compromised author accounts but can be severe for site visitors if their session is hijacked.