The Revolution Slider WordPress plugin (Slider Revolution) is vulnerable to stored cross-site scripting (CWE-79) via SVG file uploads due to inadequate input sanitization and output escaping in versions up to 6.6.20. Authenticated users with administrator privileges, and potentially authors if permissions are extended, can inject malicious scripts that execute in the context of any user viewing the affected pages. This vulnerability allows for the injection of arbitrary web scripts, potentially leading to session hijacking or other client-side impacts. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required.

The vulnerability allows authenticated users with administrator or author privileges to inject and store malicious scripts via SVG uploads. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. Exploitation requires at least low privileges and no user interaction beyond visiting the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG upload permissions to trusted administrators only and review user roles to limit who can configure or use the Slider Revolution plugin. Monitor for plugin updates from the vendor and apply them promptly once released.