WP SVG Upload WordPress Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the WP SVG Upload WordPress plugin, affecting versions through 1.0.0. The issue arises because the plugin does not properly sanitize the contents of SVG files. This lack of sanitization allows users with at least author-level permissions to upload SVG files containing malicious JavaScript, which can then be executed when the SVG is viewed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.