The azexo Elastik Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not adequately sanitized or escaped, enabling authenticated users with Author-level permissions or greater to embed arbitrary JavaScript code. This code executes in the context of users viewing the SVG file, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 0.27.4. The CVSS 3.1 base score is 6.4 (medium), with network attack vector, low attack complexity, and privileges required at the level of an authenticated author. No patch or vendor advisory is currently available.

An attacker with Author-level or higher privileges can inject malicious scripts via SVG file uploads that execute in the browsers of users who view the affected SVG files. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no impact on availability. The vulnerability requires authenticated access, limiting exposure to users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from azexo regarding patches or official mitigations.