The SVG Support plugin fails to apply sanitization to files with a .svgz extension. A user who can upload SVGs, such as an author with upload permissions, can place a script‑laden .svgz file. Because the plugin serves the file as SVG, the embedded script executes in any browser that loads the image, providing a stored XSS vector that can compromise account data and allow further payload delivery.

WordPress sites running the SVG Support plugin in any version earlier than 2.5.17 are affected. The plugin is identified as "SVG Support" and is available to all WordPress installations that have installed it.

The vulnerability has a CVSS score of 6.1, indicating medium severity. The EPSS score is < 1% and it is not listed in the CISA KEV catalog. Attackers must first obtain upload privileges (e.g., via the Author role or an attacker who has gained that capability). Once a malicious .svgz file is uploaded, the site serves the file as SVG and any visitor who opens the file, including administrators, will have the injected JavaScript executed in their browser, enabling session hijacking, defacement, or further exploitation.