Description
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Published: 2026-07-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw in the Product Addons and Product Options With Custom Fields WordPress plugin. An unauthenticated attacker can upload a SVG file because the plugin does not restrict the file‑upload endpoint. The SVG is stored and served inline, so any embedded script in the SVG will execute in the browser session of a user who later opens it.

Affected Systems

The affected product is the WordPress plugin Product Addons and Product Options With Custom Fields at any version before 1.6.15. Specific vendor information is not disclosed in the CVE record.

Risk and Exploitability

The CVSS score of 8.8 indicates a high‑severity flaw. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability but still a significant risk. Exploitation requires no authentication; the attacker simply uploads a malicious SVG through the open upload endpoint, after which any user who views the file is impacted.

Generated by OpenCVE AI on August 4, 2026 at 00:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the plugin to version 1.6.15 or later.
  • If an update is not immediately possible, disable the file‑upload endpoint or restrict access so that only authenticated administrators can upload files.
  • Ensure that only safe file types are accepted by validating MIME types and file contents, rejecting SVG uploads entirely or sanitizing them before storage.

Generated by OpenCVE AI on August 4, 2026 at 00:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Title Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-22T13:00:54.333Z

Reserved: 2026-06-23T09:24:02.548Z

Link: CVE-2026-12968

cve-icon Vulnrichment

Updated: 2026-07-22T13:00:21.433Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:15:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')