CVE-2026-2276
Awaiting Analysis Awaiting Analysis - Queue

Reflected XSS in Wix SVG Upload Enables Arbitrary Code Execution

Publication date: 2026-02-12

Last updated on: 2026-02-12

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded JavaScript code, which is stored and subsequently executed when other users view the image. Exploiting this vulnerability allows arbitrary code to be executed in the context of the victim's browser, which could lead to the disclosure of sensitive information or the abuse of the affected user's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-12
Last Modified
2026-02-12
Generated
2026-07-06
AI Q&A
2026-02-12
EPSS Evaluated
2026-07-05
NVD
CVE-2026-2276
EUVD
EUVD-2026-6176

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wix wix_web_application *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-2276 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, specifically in the endpoint https://manage.wix.com/account/account-settings that handles SVG image uploads.

The vulnerability occurs because this endpoint does not properly sanitize the content of uploaded SVG files. An authenticated attacker can upload an SVG file containing embedded JavaScript code.

When other users view the uploaded image, the malicious script is executed in their browser context, allowing arbitrary code execution.

Impact Analysis

[{'type': 'paragraph', 'content': "Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser."}, {'type': 'paragraph', 'content': "This can lead to the disclosure of sensitive information or abuse of the affected user's session, potentially compromising user accounts or data."}] [1]

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

[{'type': 'paragraph', 'content': 'There is no reported solution or patch available at this time for this vulnerability.'}, {'type': 'paragraph', 'content': "As an immediate mitigation, restrict or monitor authenticated users' ability to upload SVG files to the endpoint https://manage.wix.com/account/account-settings, since the vulnerability arises from uploading SVG files containing embedded JavaScript."}, {'type': 'paragraph', 'content': 'Additionally, consider implementing web application firewall (WAF) rules to detect and block malicious SVG uploads or scripts embedded within SVG files.'}] [1]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart