The AI Content Pipelines: Content Engine + Analytics WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Authenticated users with Author-level permissions can upload SVG files containing malicious scripts that are not properly sanitized or escaped. When these SVG files are accessed, the embedded scripts execute in the context of the user’s browser, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 1.6. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with Author-level access or higher can inject arbitrary web scripts via SVG file uploads. These scripts execute in the context of users who view the SVG files, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling SVG file uploads if possible to reduce risk.