Description

The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-20T06:17:07.777Z",
  "pubdate": "2026-08-20T06:17:07.777Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists in the Admin and Site Enhancements (ASE) WordPress plugin before version 9.0.1.\nThe security flaw stems from insufficient input sanitization applied to uploaded Scalable Vector Graphics (SVG) files across all available ingestion routes within the application.\nAuthenticated users who have been granted file upload privileges by the site administrator can supply maliciously crafted SVG documents containing embedded JavaScript payloads.\nWhen another user or administrator subsequently accesses or views the rendered SVG file within their browser context, the embedded script executes under their session.\nThis behavior introduces significant risk implications, potentially leading to privilege escalation, session hijacking, unauthorized administrative actions, or complete site compromise depending on the privileges of the victim viewing the payload.\nSuccessful exploitation requires the attacker to possess an account with file upload capabilities and relies on user interaction via browser rendering of the malicious vector.",
  "technicalDetails": "The vulnerability resides within the file upload handling mechanisms of the Admin and Site Enhancements (ASE) WordPress plugin affecting versions prior to 9.0.1.\nThe root cause of the vulnerability is improper input sanitization and failure to enforce consistent validation across every route that accepts SVG file uploads within the plugin codebase.\nBecause SVG is an XML-based vector image format capable of supporting embedded scripts via elements such as <script> or event handlers (e.g., onload), failing to sanitize the internal markup permits the storage of arbitrary JavaScript within the media library.\nThe attack flow proceeds as follows: First, an authenticated actor with permission to upload files interacts with an ingestion route lacking proper sanitization checks. Second, the actor uploads an SVG file containing a malicious JavaScript payload. Third, the application stores the raw file on the server without stripping executable content. Fourth, when a victim accesses the URL of the uploaded SVG file, the browser parses the XML and executes the embedded script within the context of the victim's session.\nThe exploitation vector requires network access to the WordPress application, authentication, and specific user roles assigned by the site owner that include file upload capabilities.\nThe payload behavior involves arbitrary script execution within the victim browser, which can interact with the Document Object Model (DOM), access cookies, perform actions on behalf of the authenticated user, or leverage post-exploitation techniques such as injecting persistent administrative backdoors."
}