The Elemenda plugin for WordPress (themeid) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not properly sanitized or escaped, enabling attackers with Author-level or higher privileges to inject arbitrary JavaScript payloads. These payloads execute in the context of any user who views the injected SVG content. The vulnerability affects all versions up to 0.0.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated user with Author-level privileges or higher to inject and execute arbitrary scripts in the context of other users viewing the SVG files. This can lead to confidentiality and integrity impacts such as session hijacking, defacement, or unauthorized actions performed on behalf of other users. There is no reported impact on availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level and higher privileges to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the plugin vendor or WordPress security advisories for an official fix.