A stored Cross‑Site Scripting vulnerability exists in the Media Manager of TastyIgniter v4.3.0. It is caused by insufficient sanitization of SVG files during upload. An authenticated user with low privileges can upload a crafted SVG containing JavaScript. When an administrator later opens that file in the browser, the embedded script runs with administrator privileges, enabling further actions such as extracting the admin’s CSRF token. By chaining this stored XSS with a Cross‑Site Request Forgery, an attacker can perform unauthorized login‑changing or other privileged operations, effectively taking full control of the admin account.

The affected product is Media Manager for TastyIgniter, specifically version 4.3.0. The vulnerability is limited to the Media Manager component and does not affect other core TastyIgniter modules unless they also expose the same upload interface.

The CVSS score of 6.3 indicates a medium‑severity vulnerability. The EPSS score is reported as < 1% (approximately 0.0023), indicating a very low, but non‑zero exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog, which suggests it has not been widely exploited yet. However, the required conditions—a low‑privilege authenticated user and an administrator who views the uploaded file—are realistic in many environments. If an attacker can obtain or guess the CSRF token via the XSS execution, the risk escalates to full administrative compromise. Because the exploitation path involves multiple steps, the overall risk to systems with default configurations is moderate but still warrants prompt attention.