Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

Description

The plugin does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed plugin exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.