CVE-2026-106933: Blaze Demo Importer WordPress XSS Flaw

CVE-2026-106933 Overview

CVE-2026-106933 is a stored Cross-Site Scripting (XSS) vulnerability in the Blaze Demo Importer WordPress plugin in versions prior to 1.0.17. The plugin fails to sanitize uploaded Scalable Vector Graphics (SVG) files and unconditionally registers the SVG Multipurpose Internet Mail Extensions (MIME) type with the WordPress media library. Authenticated users with the Author role or higher can upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who views the file. The weakness is tracked under CWE-79.

Critical Impact
An authenticated attacker with Author privileges or higher can achieve stored XSS against administrators, enabling session theft, account takeover, and administrative action hijacking.

Affected Products

Blaze Demo Importer WordPress plugin versions prior to 1.0.17
WordPress sites that permit Author-level or higher user registration
WordPress media library installations with the vulnerable plugin active

Discovery Timeline

2026-10-19 - CVE-2026-106933 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-106933

Vulnerability Analysis

The Blaze Demo Importer plugin registers the image/svg+xml MIME type for the WordPress media library without applying any sanitization to the uploaded file contents. SVG files are Extensible Markup Language (XML) documents that natively support <script> elements and JavaScript event handlers such as onload and onclick. When WordPress serves the file through the media library or embeds it in a post, the browser parses and executes any embedded script in the context of the site origin.

The attacker needs an authenticated session with the Author role or higher, which raises the privilege barrier but still fits common blog, publishing, and multi-author site configurations. Once stored, the payload fires each time an administrator previews the file in the media library, grants the attacker access to the administrator's session cookies, nonces, and the WordPress REST Application Programming Interface (API) under administrative privileges.

Root Cause

The plugin unconditionally adds the SVG MIME type to the WordPress upload_mimes filter and skips content inspection on the uploaded payload. There is no stripping of <script> tags, foreign namespaces, or JavaScript Uniform Resource Identifier (URI) handlers before the file is written to disk and indexed in the media library.

Attack Vector

An attacker authenticates to a vulnerable WordPress site using Author-level credentials. The attacker uploads a crafted SVG file containing a <script> element or an event handler such as onload through the standard media uploader. When an administrator or other authenticated user opens the SVG in the media library or on a page where the asset is embedded, the browser executes the embedded JavaScript under the site origin. The payload can issue authenticated requests, create new administrator accounts, or exfiltrate session data. Further technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-106933

Indicators of Compromise

Presence of .svg files in wp-content/uploads/ containing <script> tags, on* event handler attributes, or javascript: Uniform Resource Identifiers
WordPress media library entries with the image/svg+xml MIME type uploaded by Author-level accounts
Creation of new administrator accounts or role modifications shortly after SVG uploads by non-administrator users

Detection Strategies

Scan the uploads directory for SVG files and inspect their XML content for scriptable elements and event handlers
Audit the upload_mimes filter output on the WordPress site to confirm whether SVG registration is active and attribute it to the installed plugin
Correlate media upload events in WordPress logs with subsequent privileged actions originating from administrator sessions

Monitoring Recommendations

Enable WordPress audit logging for file uploads, user role changes, and plugin activation events
Monitor outbound requests from administrator browser sessions for anomalous traffic to attacker-controlled domains
Alert on any SVG file whose content contains <script, onload=, onerror=, or xlink:href="javascript: patterns

How to Mitigate CVE-2026-106933

Immediate Actions Required

Update the Blaze Demo Importer plugin to version 1.0.17 or later on all WordPress installations
Review Author-level and higher accounts for recent SVG uploads and remove any files containing executable content
Rotate administrator passwords and invalidate active sessions if suspicious SVG uploads are present

Patch Information

The vendor addressed the issue in Blaze Demo Importer version 1.0.17 by removing the unconditional SVG MIME registration and adding sanitization for uploaded SVG content. Review the WPScan Vulnerability Report for vendor coordination details.

Workarounds

Deactivate the Blaze Demo Importer plugin until the site can be updated to version 1.0.17 or later
Restrict Author-role assignment and require administrator approval for any user capable of uploading media
Deploy a WordPress hardening plugin or Web Application Firewall rule that strips scriptable content from SVG uploads

bash

# Configuration example: remove SVG MIME support via a mu-plugin until patched
add_filter( 'upload_mimes', function( $mimes ) {
    unset( $mimes['svg'] );
    unset( $mimes['svgz'] );
    return $mimes;
}, 999 );