An attacker can upload an SVG file containing malicious script to the site, and the file is executed in the victim’s browser when the file is viewed. The upload functionality accepts the SVG type without sanitisation, so the script runs in the context of the site, allowing attackers to steal credentials, deface the site, or install malware on visitors. This is a classic stored XSS flaw that can compromise the confidentiality, integrity, and availability of the site’s content.

WordPress sites using the All in One Files Upload plugin, versions 2.0.3 through 2.0.16. The flaw exists because these releases allow SVG to be uploaded without validating the upload request or sanitising the content. Users of any of these plugin versions are affected unless the plugin is upgraded to 2.0.17 or later or the upload feature is disabled.

The vulnerability permits unauthenticated users to store and trigger arbitrary script execution on the site. The CVSS score of 8.8 indicates a high severity, and the EPSS score of < 1% shows a low exploitation probability, but the lack of authentication and ability to host active content still create a high‑risk condition. The flaw is not listed in the CISA KEV catalog, but it is still an actionable security risk because it allows a remote attacker to deliver malicious code to users directly through the site’s origin.