Unrated severityNVD Advisory· Published Oct 19, 2026
CVE-2026-106933
CVE-2026-106933
Description
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.0.17
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.