All vulnerabilities
CVE-2026-19615
Medium
CVSS 6.8
Stored XSS via unsanitised SVG upload in Admin and Site Enhancements
| Vendor | WPease |
|---|---|
| Product | Admin and Site Enhancements (ASE) |
| Affected versions | < 9.0.1 |
| Weakness | CWE-79 |
| Reported | 2026-08-18 |
| Disclosed | 2026-08-18 |
| Status | Published |
Discovered and responsibly disclosed CVE-2026-19615, an Author+ Stored XSS vulnerability in the "Admin and Site Enhancements (ASE)" plugin. The plugin failed to sanitize uploaded SVG files across all routes — including via XML-RPC — allowing an authenticated user to store JavaScript that executes in the browser of anyone who opens the file. Fixed in version 9.0.1 (CVSS 6.8, CWE-79)
Related disclosures
High
Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Medium
Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
View all