The vulnerable Safe SVG plugin allows a contributor to inject malicious script code through certain input fields, causing a cross‑site scripting vulnerability that can be triggered when an authenticated or unauthenticated user views the page. The weakness is a type of input validation flaw identified as CWE‑79 and permits the attacker to run arbitrary client‑side code in the context of the affected website, potentially leading to session hijacking, credential theft, or defacement. The impact as described is limited to the web application and its users, and it does not provide direct server‑side code execution.

WordPress sites running the 10up Safe SVG plugin version 2.5.0 or earlier. The plugin’s older releases contain the unchecked input handling that is the source of the XSS flaw.

The CVSS score is 6.5, indicating a moderate severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploit is known in the wild. Based on the description, the likely attack vector is a malicious contributor submitting content through the plugin’s input interface, which is then rendered by unsuspecting visitors.