CVE-2026-19615: Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC

Q: Who can exploit this issue?

An attacker must have a WordPress role that the site owner has granted permission to upload files. The affected upload path is XML-RPC, and the attacker can upload an SVG containing JavaScript.

Q: Who is exposed when a malicious SVG has been uploaded?

Anyone who opens the uploaded SVG in their browser can have the embedded JavaScript execute. This includes users other than the uploader who are able to access the file.

Q: Which installations are affected?

Admin and Site Enhancements versions before 9.0.1 are affected. The available information does not establish whether upload access or the relevant XML-RPC route is enabled by default.

Published Aug 20, 2026

Updated

The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.

Affected Software

1 affected component

WordPress Admin and Site Enhancements (ASE)<9.0.1

Event History

Aug 20, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must have a WordPress role that the site owner has granted permission to upload files. The affected upload path is XML-RPC, and the attacker can upload an SVG containing JavaScript.

Who is exposed when a malicious SVG has been uploaded?

Anyone who opens the uploaded SVG in their browser can have the embedded JavaScript execute. This includes users other than the uploader who are able to access the file.

Which installations are affected?

Admin and Site Enhancements versions before 9.0.1 are affected. The available information does not establish whether upload access or the relevant XML-RPC route is enabled by default.