The software is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping in the `data-to-image.php` and `pdf-to-image.php` files allow unauthenticated attackers to inject arbitrary web scripts. These scripts execute when a user accesses the SVG file.