CVE-2026-106933: Blaze Demo Importer 0 to before 1.0.17

Affected technology

Blaze Demo Importer · 0 to before 1.0.17
Vendor not specified by the source

Description’s affected range: before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally

Component: Not specified by the source

What an attacker can do

Authenticated users with the Author role or higher can upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.