MEDIUMCVSS v3.1 6.8Vulnerability
CVE-2026-106933
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.0029
- Cvss severity
- MEDIUM
- Cvss score
- 6.8
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Last source
- FIRST EPSS
- Score
- 6.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-106933
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-19T06:58:53+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-10-19T06:17:20.817
- Last modified
- 2026-10-19T21:04:50.950
- Epss percentile
- 0.20304
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph