CVE-2026-85573: All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it because the plugin does not verify the authenticity of its public upload requests. They can upload an SVG file containing active content without needing an account.
What has to happen for the stored content to execute?
A victim must open the uploaded SVG. The active content then runs in the site's origin, which can expose users interacting with the file to cross-site scripting.
Are affected sites exposed by the plugin's upload configuration?
The affected plugin versions add SVG to the site's allowed upload types and do not sanitize uploaded files. This creates exposure wherever the plugin's public upload requests are reachable.
Which versions need remediation?
Versions 2.0.3 through 2.0.16 are affected. Version 2.0.17 is the first version identified as not affected by this issue.