PT-2026-103043 · WordPress · Verge3D Publishing/E-Commerce
CVE-2026-92994
·
Published
2026-09-30
·
Updated
2026-09-30
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Verge3D Publishing and E-Commerce WordPress plugin versions prior to 4.13.1
Description
Insufficient validation of files uploaded through the file storage feature allows unauthenticated attackers to upload files containing malicious JavaScript. The plugin serves these files back with a content type controlled by the attacker, leading to the execution of the script in the browser of any user who accesses the file.
Recommendations
Update the Verge3D Publishing and E-Commerce WordPress plugin to version 4.13.1 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Verge3D Publishing/E-Commerce