The Otter Blocks WordPress plugin suffers from CWE-434: Unrestricted Upload of File with Dangerous Type, specifically allowing SVG files containing malicious scripts to be uploaded by authenticated users with author-level privileges. Due to inadequate sanitization and escaping of SVG content, these scripts are stored and executed in the context of users visiting the compromised pages, enabling stored XSS attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at author level, no user interaction, and partial impact on confidentiality and integrity without availability impact.

An attacker with author-level access can inject arbitrary web scripts via SVG file uploads that execute in the browsers of users viewing the infected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the context of the affected site. There is no indication of impact on system availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level user permissions to trusted users only and consider disabling SVG uploads if possible. Monitor official themeisle communications for updates and apply any released patches promptly.