CVE-2026-85573

Name of the Vulnerable Software and Affected Versions All in One Files Upload WordPress plugin versions prior to 2.0.17

Description The plugin allows unauthenticated users to upload files containing active content because it adds SVG to the allowed upload types without sanitizing the files or verifying the authenticity of public upload requests. This allows the uploaded content to execute within the site's origin when accessed by a victim.

Recommendations Update All in One Files Upload WordPress plugin to version 2.0.17 or later.