CVE-2026-106933
Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
Unknown Blaze Demo Importer
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.0.17Blaze Demo ImporterCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
Text from CVE List
Affected versions 1
- Blaze Demo Importeraffected: all versions before 1.0.17CVE List