What’s Vulnerable › Vulnerabilities
CVE-2026-106933: Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-19 · updated 2026-10-19
- Weakness: CWE-79
Description
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
Affected products
- Blaze Demo Importer: before 1.0.17 — fixed in 1.0.17
How to fix
Upgrade to a fixed version: Blaze Demo Importer 1.0.17. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-106933 or the next vulnerability affects your stack