CVE-2026-94077 is an XSS vulnerability classified under CWE-79 in the 10up Safe SVG plugin versions up to 2.5.0. It arises from improper neutralization of input during web page generation, allowing an attacker with contributor privileges to inject malicious scripts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges but user interaction, and impacts confidentiality, integrity, and availability with a scope change.

An attacker with contributor-level access can exploit this vulnerability to execute arbitrary scripts in the context of the affected web application. This can lead to partial compromise of confidentiality, integrity, and availability of the application or user data. However, exploitation requires user interaction and contributor privileges, limiting the attack surface.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit contributor privileges and monitor for suspicious activity related to SVG uploads or rendering.