6.8
Moyenne
CVE-2026-19615 The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every…
Description
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Admin and Site Enhancements (ASE) 9.0 | premières → < 9.0.1 | 9.0.1 |
Autres CVE de Admin and Site Enhancements (ASE)
Les 5 CVE de Admin and Site Enhancements (ASE) →
CVE-2026-12083
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before…
8.1
Élevée
CVE-2025-9487
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via…
4.7
Moyenne
CVE-2024-13688
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password…
5.3
Moyenne
CVE-2024-13685
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially…
5.3
Moyenne