PT-2026-78891 · WordPress · Admin/Site Enhancements
CVE-2026-19615
·
Published
2026-08-20
·
Updated
2026-08-20
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Admin and Site Enhancements versions prior to 9.0.1
Description
Insufficient sanitization of uploaded SVG files across certain routes allows users with upload permissions to store files containing malicious JavaScript. This leads to a stored Cross-Site Scripting (XSS) condition, where the script executes in the browser of any user who opens the uploaded file.
Recommendations
Update Admin and Site Enhancements to version 9.0.1 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Admin/Site Enhancements