Blaze Demo Importer does not sanitize uploaded SVG files, allowing an authenticated Author or higher to submit a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file. This stored cross‑site scripting can reveal session data, hijack accounts, or perform malicious actions in the victim’s context.

The WordPress plugin Blaze Demo Importer, versions older than 1.0.17, is vulnerable. Any site running an affected version is at risk whenever an author or higher role uploads an SVG.

The flaw requires an authenticated user with at least Author privileges to upload the file, which limits the initial attack surface. However, once the SVG is present in the media library, any visitor who views the file triggers the script, providing widespread impact on confidentiality and integrity. EPSS data is unavailable and the vulnerability is not listed in KEV; with a CVSS score of 6.8 it represents a medium‑severity stored XSS that poses a significant risk.