CVE-2026-106933: CWE-79 Cross-Site Scripting (XSS) in Blaze Demo Importer

CVE-2026-106933 is a Cross-Site Scripting (CWE-79) vulnerability in the Blaze Demo Importer WordPress plugin versions before 1.0.17. The plugin fails to sanitize SVG files uploaded by authenticated users with Author or higher roles and registers the SVG MIME type for the WordPress media library without restrictions. This allows these users to upload malicious SVG files containing JavaScript, which executes in the browser context of any user who views the file, potentially leading to script execution attacks.

Authenticated users with Author or higher privileges can exploit this vulnerability to upload malicious SVG files that execute arbitrary JavaScript in the browsers of other users who view the files. This could lead to session hijacking, defacement, or other client-side attacks depending on the context in which the SVG is viewed.

Upgrade the Blaze Demo Importer plugin to version 1.0.17 or later, where this vulnerability is fixed. Since no official patch link is provided, users should verify the plugin version and update accordingly. Restrict upload permissions to trusted users and avoid allowing untrusted users to upload SVG files until the plugin is updated.