CVE-2026-19615
Received Received - Intake

Admin and Site Enhancements SVG File Stored XSS

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: WPScan

Description
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-19615
EUVD
EUVD-2026-63203

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpsecure admin_and_site_enhancements to 9.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue in the Admin and Site Enhancements WordPress plugin versions before 9.0.1. It occurs because the plugin does not properly sanitize uploaded SVG files, allowing users with upload permissions to store files containing malicious JavaScript. When these files are opened in a browser, the embedded script executes.

Detection Guidance

Check if the Admin and Site Enhancements plugin version is below 9.0.1. Inspect uploaded SVG files for embedded JavaScript or suspicious content. Review user roles with upload permissions for unauthorized access.

Impact Analysis

If you have upload permissions on a vulnerable site, an attacker could upload a malicious SVG file containing JavaScript. When you or other users open the file, the script executes in your browser, potentially leading to unauthorized actions, data theft, or further compromise of your session.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using the vulnerable plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update the Admin and Site Enhancements plugin to version 9.0.1 or later immediately. Remove any untrusted SVG files from the system. Audit user roles to ensure only necessary users have upload permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart