The Easy Demo Importer plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not adequately sanitized or escaped, enabling authenticated users with Author-level privileges or above to embed arbitrary JavaScript code. This code executes in the context of users viewing the SVG files, potentially leading to information disclosure or manipulation. The vulnerability affects all versions up to and including 1.1.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the Author level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with Author-level access or higher can exploit this vulnerability to inject persistent malicious scripts via SVG file uploads. These scripts execute in the browsers of users who view the SVG files, potentially leading to unauthorized disclosure or modification of information within the affected site context. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict SVG file upload permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for plugin updates from sigmadevs addressing this vulnerability and apply them promptly once available.