WordPress YMC Filter plugin < 3.12.9 - Author+ Stored XSS via SVG Icon Upload vulnerability

Author+ Stored XSS via SVG Icon Upload vulnerability discovered by Artus KG in WordPress Plugin Filter & Grids versions 3.12.9...

CVE-2026-19615

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

CVE-2026-19697

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

EUVD-2026-63203

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

CVE-2026-19615 Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

CVE-2026-19697 GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

CVE-2026-19615

The Admin and Site Enhancements (ASE) WordPress plugin, in versions prior to 9.0.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize uploaded SVG files across all accepted routes, specifically allowing for exploitation via XML-RPC . An attacker with a ...

CVE-2026-19697 GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

EUVD-2026-63204

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

CVE-2026-19697

The GutenKit WordPress plugin, in versions prior to 2.5.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitise uploaded SVG files across all enabled upload paths. This allows users with file upload privileges, such as those with the Author role, to upload...

CVE-2026-19615 Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

PT-2026-78891

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

PT-2026-78892

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

CVE-2026-19615: Improper Neutralization of Input During Web Page Generation

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

PT-2026-79139

Name of the Vulnerable Software and Affected Versions @dicebear/core versions prior to 9.4.3 @dicebear/initials versions prior to 9.4.3 Description An issue exists where certain options are interpolated into SVG attributes without XML escaping. In @dicebear/core, the addRotate function fails to...

CVE-2026-68921: Improper Neutralization of Input During Web Page Generation

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-19697: Improper Neutralization of Input During Web Page Generation

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

CVE-2026-49825: Improper Neutralization of Input During Web Page Generation

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean 0.4...

CVE-2026-61607

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...