The File Upload Types by WPForms plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SVG files uploaded by authenticated users with Author-level privileges or higher are not properly sanitized or escaped, enabling injection of arbitrary web scripts. These scripts execute in the context of users viewing the SVG files, potentially leading to client-side code execution. The vulnerability affects all versions up to 1.4.0. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No patch or vendor advisory is currently provided, and no known exploits have been reported.

An authenticated attacker with Author-level or higher privileges can upload a crafted SVG file containing malicious scripts. These scripts execute in the browsers of users who access the SVG file, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the plugin vendor and apply any official patches promptly once available.