6.8
Medium
CVE-2026-19615 The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every…
Description
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Admin and Site Enhancements (ASE) 9.0 | earliest → < 9.0.1 | 9.0.1 |
Other CVEs of Admin and Site Enhancements (ASE)
The 5 CVEs of Admin and Site Enhancements (ASE) →
CVE-2026-12083
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before…
8.1
High
CVE-2025-9487
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via…
4.7
Medium
CVE-2024-13688
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password…
5.3
Medium
CVE-2024-13685
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially…
5.3
Medium