CVE-2026-104676: Zion Builder <= 3.6.17 - Author+ Stored XSS via SVG Upload
The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Author role or a higher-privileged role can exploit it by uploading a crafted SVG file.
Who is exposed to the malicious JavaScript?
Anyone who opens the uploaded SVG file in a browser can have the embedded JavaScript execute. The file is served from the affected site's own origin.
Is user interaction required for exploitation?
Yes. An attacker must first authenticate with an Author-or-higher account and upload a crafted SVG, and a victim must open that uploaded file.
How can I determine whether my site is affected?
Sites using Zion Builder version 3.6.17 or earlier are affected according to the available information. Review SVG uploads made by Author-level and higher accounts for unexpected or untrusted files.