CVE-2026-12968

Name of the Vulnerable Software and Affected Versions Product Addons and Product Options With Custom Fields versions prior to 1.6.15

Description An unauthenticated file-upload endpoint does not restrict access and accepts SVG files that are stored and served inline. This allows an unauthenticated attacker to upload a malicious SVG file containing an embedded script. The script executes in the session of any user, including administrators, who opens the file, resulting in Stored Cross-Site Scripting (XSS), which is a technique where malicious scripts are permanently stored on a target server.

Recommendations Update to version 1.6.15 or later.