CVE-2026-121796 PUBLISHED

Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload

Assigner: WPScan
Reserved: 04.11.2026 Published: 07.11.2026 Updated: 07.11.2026

The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.

Product Status

Vendor Unknown
Product Add From Server Lite
Versions Default: unaffected
  • affected from 0 to 6.0.0 (excl.)

Credits

  • Kovserov Hikmet finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE