CVE-2026-85573

The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to unauthenticated stored XSS . The plugin adds SVG to the allowed upload types but fails to sanitise uploaded files or verify the authenticity of public upload requests . This allows an unauthentica...