All vulnerabilities
CVE-2026-19615
Medium
CVSS 6.8
Stored XSS via unsanitised SVG upload in Admin and Site Enhancements
| Vendor | WPease |
|---|---|
| Product | Admin and Site Enhancements (ASE) |
| Affected versions | < 9.0.1 |
| Weakness | CWE-79 |
| Reported | 2026-08-18 |
| Disclosed | 2026-08-18 |
| Status | Published |
Discovered and responsibly disclosed CVE-2026-19615, an Author+ Stored XSS vulnerability in the "Admin and Site Enhancements (ASE)" plugin. The plugin failed to sanitize uploaded SVG files across all routes — including via XML-RPC — allowing an authenticated user to store JavaScript that executes in the browser of anyone who opens the file. Fixed in version 9.0.1 (CVSS 6.8, CWE-79)
Related disclosures
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
Medium
Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload
Medium
Kirki Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
View all