CVE-2026-85573
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload…
- Risk score
- 62/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim open…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.0.17 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.
Last activity 30 Sep 2026. Patch Forecast updates every hour.