The Preloader Plus – WordPress Loading Screen Plugin for WordPress versions up to and including 2.2.1 suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin does not adequately sanitize or escape SVG file uploads, enabling authenticated attackers with Author-level permissions or higher to inject arbitrary web scripts. These scripts execute in the context of users who view the SVG files, potentially leading to session hijacking or other script-based attacks. The vulnerability is tracked as CVE-2024-6849 with a CVSS v3.1 base score of 6.4 (medium severity). No patch or remediation details are provided in the available data.

An attacker with Author-level or higher privileges can exploit this vulnerability to inject and store malicious scripts via SVG file uploads. These scripts execute whenever a user accesses the SVG file, potentially compromising user sessions or performing unauthorized actions within the affected WordPress site. The impact is limited to confidentiality and integrity (partial), with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated exploits. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level and higher user permissions to trusted individuals only. Consider disabling SVG file uploads if not required or implementing additional input validation and sanitization controls at the application or web server level to mitigate risk.