CVE-2026-121796: Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload

Q: Which users can exploit this issue?

Users with the WordPress Author role or higher can exploit the issue by uploading a crafted SVG file containing JavaScript. The plugin does not require that those users have the unfiltered HTML capability.

Q: What versions are affected?

Add From Server Lite versions before 6.0.0 are affected. Upgrading to version 6.0.0 or later addresses the affected version range.

Q: What is the impact of a successful exploit?

A successful upload can result in stored cross-site scripting. JavaScript embedded in the SVG can execute when the malicious file is viewed in a relevant browser context.

Published Nov 7, 2026

Updated

The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/add-from-server-lite to a version that resolves this vulnerability.
Fixed in 6.0.0

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Users with the WordPress Author role or higher can exploit the issue by uploading a crafted SVG file containing JavaScript. The plugin does not require that those users have the unfiltered HTML capability.

What versions are affected?

Add From Server Lite versions before 6.0.0 are affected. Upgrading to version 6.0.0 or later addresses the affected version range.

What is the impact of a successful exploit?

A successful upload can result in stored cross-site scripting. JavaScript embedded in the SVG can execute when the malicious file is viewed in a relevant browser context.

CVE-2026-121796: Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What versions are affected?

What is the impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What versions are affected?

What is the impact of a successful exploit?