Executive brief
The Admin and Site Enhancements WordPress plugin is a popular tool that site administrators use to manage uploads and enhance site functionality. A vulnerability in versions before 9.0.1 fails to properly sanitize SVG image files uploaded through certain code paths, allowing users with upload permissions to store malicious scripts that execute when anyone views the file in a browser, potentially stealing credentials or site data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Admin and Site Enhancements plugin. The root cause is incomplete input sanitization of SVG file uploads across multiple upload routes. An attacker with Author or higher role (with SVG upload enabled) can exploit the XML-RPC metaWeblog.newMediaObject endpoint by submitting a malicious SVG file with embedded JavaScript or event handlers; the plugin fails to strip these on this specific route while properly sanitizing the same payload through REST and direct upload paths. The unsanitized file is stored and later retrieved without authentication, causing the JavaScript to execute in the browser of any user who accesses it within the site's security context. Version 9.0.1 and later address this issue through comprehensive sanitization.
Affected products
- WordPress.org Admin and Site Enhancements before 9.0.1
Timeline
- 2026-08-18: disclosed
- 2026-08-20: patched: Version 9.0.1 released