CVE-2026-106933 — Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload

CVE-2026-106933

Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload PUBLISHED

Description (CNA)

The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

Affected (CNA)

Vendor / product	Versions
Unknown / Blaze Demo Importer	affected 0 before 1.0.17

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4f85834c-30e4-451f-9616-70dc8eaf9c41/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.