CVE-2026-106933: Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload

Q: Who can exploit this issue, and who is exposed to the payload?

An authenticated WordPress user with the Author role or a higher role can upload a crafted SVG. The JavaScript executes in the browser of any user who opens that uploaded file.

Q: Are default plugin installations affected?

Affected versions register the SVG MIME type for the WordPress media library unconditionally. This means SVG upload support is enabled by the plugin without requiring a separate configuration change.

Q: How can I determine whether my site may be affected?

Check whether Blaze Demo Importer is installed at a version earlier than 1.0.17. Review the WordPress media library for SVG files uploaded by Author-level or higher accounts, particularly files that may have been opened by other users.

Published Oct 19, 2026

Updated

The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

Affected Software

1 affected component

Blaze Themes Blaze Demo Importer<1.0.17

Event History

Oct 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

An authenticated WordPress user with the Author role or a higher role can upload a crafted SVG. The JavaScript executes in the browser of any user who opens that uploaded file.

Are default plugin installations affected?

Affected versions register the SVG MIME type for the WordPress media library unconditionally. This means SVG upload support is enabled by the plugin without requiring a separate configuration change.

How can I determine whether my site may be affected?

Check whether Blaze Demo Importer is installed at a version earlier than 1.0.17. Review the WordPress media library for SVG files uploaded by Author-level or higher accounts, particularly files that may have been opened by other users.

CVE-2026-106933: Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Are default plugin installations affected?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Are default plugin installations affected?

How can I determine whether my site may be affected?