WordPress Plugin Vulnerabilities

Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload

Description

The plugin does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.

Proof of Concept

Affects Plugins

Plugin icon
add-from-server-reloaded
Fixed in 6.0.0

References

CVE
CVE-2026-121796

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Kovserov Hikmet
Submitter
Kovserov Hikmet
Verified
Yes
WPVDB ID
1678486d-97cb-4a31-bb03-ef916f8bf497

Timeline

Publicly Published
2026-11-05 (about 2 days ago)
Added
2026-11-05 (about 1 day ago)
Last Updated
2026-11-05 (about 1 day ago)

Other

Published
Title
Published
2026-06-11
Title
The Ultimate Video Player For WordPress < 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
Published
2024-09-25
Title
Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2020-04-28
Title
Gmedia Photo Gallery < 1.18.5 - Multiple Cross-Site Scripting (XSS)
Published
2014-08-01
Title
allure-real-estate-theme-for-real-estate <= 0.1.1 - XSS in ZeroClipboard.swf
Published
2023-02-24
Title
Chat Bee <= 1.1.0 - Admin+ Stored XSS