The BSK PDF Manager plugin in WordPress is vulnerable to stored XSS through SVG file uploads in versions up to 3.7.1. Insufficient sanitization of SVG content allows an Administrator or higher to embed malicious scripts that run for any user who opens the file. This flaw can lead to session hijacking, credential theft, or defacement when the script executes, affecting confidentiality, integrity, and availability of the site.

WordPress sites running the BSK PDF Manager plugin version 3.7.1 or earlier on a multisite network, where the unfiltered_html option is disabled. Administrators with upload permissions can exploit the flaw; all users who view the SVG files are impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% signals low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Administrator level and the ability to upload an SVG file. An attacker must do so in a multisite environment with unfiltered_html turned off and then lure other users to view the injected file for the scripts to run.