The Slider Revolution plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not adequately sanitized or escaped, enabling authenticated users with Author-level or higher privileges to embed arbitrary scripts. These scripts execute in the context of users viewing the SVG, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 6.7.18. Exploitation requires at least Author-level access, which by default is limited to administrators but can be extended. There is no vendor advisory or patch information provided, so patch status is unknown.

An attacker with Author-level or higher privileges can inject persistent malicious scripts via SVG uploads that execute in users' browsers when accessing the SVG. This can lead to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access, limiting its scope. The CVSS score of 6.4 reflects a medium severity impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG upload permissions to trusted users only and consider limiting Author-level access. Monitor for plugin updates from the vendor and apply them promptly once released.