Plunk, an open‑source email platform, had an image upload endpoint that accepted SVG files up to version 0.6.x. SVG files are treated by modern browsers as active documents capable of executing embedded JavaScript. When an attacker uploads a malicious SVG, the script runs in the context of any user who views the file, enabling classic XSS attacks such as cookie theft, session hijacking, or content injection. This vulnerability falls under CWE‑79 as it involves improper handling of user input that is rendered by the browser.

The vulnerability affects the Plunk email platform from the vendor useplunk. All versions prior to 0.7.1 expose the flaw; the fix was introduced in release 0.7.1.

The CVSS score of 5.4 indicates moderate severity. EPSS for this issue is reported to be less than 1%, suggesting a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to upload a crafted SVG to the image endpoint; once uploaded, any user who views the file will be exposed. The attack vector is inferred to be via the upload functionality, likely requiring either authenticated access or unauthenticated access to the image upload endpoint, as the description does not explicitly state access restrictions.