The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via SVG file uploads. Authenticated attackers with Author-level privileges or above can upload crafted SVG files containing malicious scripts that are not properly sanitized or escaped. This leads to script execution in the context of users viewing the SVG, potentially compromising user sessions or performing unauthorized actions. The vulnerability affects all plugin versions up to 1.4.7. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the Author level, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch link available at this time, and no known active exploitation has been reported.

An attacker with Author-level access or higher can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users accessing the malicious SVG file. This can lead to unauthorized actions such as session hijacking or data manipulation affecting confidentiality and integrity. The vulnerability does not impact availability. Since the attacker must be authenticated with Author privileges, the risk is limited to environments where such access is granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling SVG file uploads if possible. Monitor plugin updates from climaxthemes for a security patch addressing this issue.