The vulnerability is a reflected cross‑site scripting flaw (CWE‑79) in Wix’s image upload endpoint. An authenticated attacker can upload an SVG file containing embedded JavaScript, which is stored and then executed when other users view the image. This allows the attacker to run arbitrary code in the victim’s browser, potentially revealing sensitive data or hijacking the victim’s session.

The flaw affects all versions of the Wix web application, specifically the account‑settings image upload feature accessed through https://manage.wix.com/account/account-settings.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of < 1% suggests a low likelihood of exploitation so far. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the target account to upload the malicious SVG; unprivileged users who view the image become the victims.