CVE-2026-12968
Deferred Deferred - Pending Action

Unauthenticated SVG File Upload in Product Addons and Options Plugin

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: WPScan

Description
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-10
NVD
CVE-2026-12968
EUVD
EUVD-2026-47612

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wowaddons product_addons to 1.6.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated stored Cross-Site Scripting (XSS) flaw in the WordPress plugin 'Product Addons – WowAddons' before version 1.6.15. It allows attackers to upload malicious SVG files without authentication. These files are stored and served inline, executing embedded scripts when accessed by users like administrators, potentially leading to unauthorized actions or data theft.

Detection Guidance

Check for unauthorized SVG files in the plugin's upload directory, particularly in the 'wp-content/uploads/wowaddons/' or similar paths. Look for recent uploads with suspicious filenames or embedded scripts. Use commands like 'find /path/to/uploads -name "*.svg" -type f -exec grep -l "<script>" {} \;' to scan for malicious SVGs.

Impact Analysis

If you use the vulnerable plugin, an attacker could upload a malicious SVG file that executes scripts when you or other users view it. This could allow the attacker to steal session cookies, perform actions on your behalf, or access sensitive data, potentially compromising your WordPress site and user accounts.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. A breach could result in legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Immediately update the 'Product Addons – WowAddons' plugin to version 1.6.15 or later. If updating is not possible, disable the plugin entirely. Remove any unauthorized SVG files from the upload directory and monitor for unusual activity. Restrict file uploads to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12968. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart