WordPress Plugin Vulnerabilities

Blaze Demo Importer <= 1.0.16 - Author+ Stored XSS via SVG Upload

Description

The plugin does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

Proof of Concept

Affects Plugins

Plugin icon
blaze-demo-importer
No known fix

References

CVE
CVE-2026-106933

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Luis Schlegel
Submitter
Luis Schlegel
Submitter website
https://www.ctxzero.dev
Verified
Yes
WPVDB ID
4f85834c-30e4-451f-9616-70dc8eaf9c41

Timeline

Publicly Published
2026-10-16 (about 1 day ago)
Added
2026-10-09 (about 5 days ago)
Last Updated
2026-10-09 (about 5 days ago)

Other

Published
Title
Published
2026-10-09
Title
Photo Reviews for WooCommerce < 1.2.31 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
Published
2026-03-20
Title
Any Post Slider < 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute
Published
2026-01-06
Title
1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Published
2024-05-27
Title
FV Flowplayer Video Player < 7.5.46.7212 - Reflected Cross-Site Scripting
Published
2023-02-15
Title
Easy Panorama < 1.1.5 - Admin+ Stored XSS