Skip to content
Sign in
4.7 Medium

CVE-2025-9487 The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via…

Description

The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads

Affected products and versions

Product Affected versions Fixed in
Admin and Site Enhancements (ASE) 7.9 earliest → < 7.9.8 7.9.8

Other CVEs of Admin and Site Enhancements (ASE)

The 5 CVEs of Admin and Site Enhancements (ASE) →
CVE-2026-19615 The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every… 6.8 Medium CVE-2026-12083 The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before… 8.1 High CVE-2024-13688 The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password… 5.3 Medium CVE-2024-13685 The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially… 5.3 Medium
Track this CVE