{"id":"CVE-2026-12968","aliases":["EUVD-2026-47612","GHSA-m254-gmq9-65xp"],"status":"published","title":"Product Addons – WowAddons \u003c 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload","description":"The Product Addons and Product Options With Custom Fields  WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00505,"percentile":0.4347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-22T06:00:02Z","modified":"2026-07-22T16:30:26Z","products":[{"vendor":"unknown","product":"product addons and product options with custom fields"}],"references":[{"url":"https://wpscan.com/vulnerability/8ae2ff84-a4a0-4fb1-842b-b3193e673d27/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12968"},{"url":"https://wpscan.com/vulnerability/8ae2ff84-a4a0-4fb1-842b-b3193e673d27"},{"url":"https://github.com/advisories/GHSA-m254-gmq9-65xp"}],"sources":{"cve":[{"id":"CVE-2026-12968","title":"Product Addons – WowAddons \u003c 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload","description":"The Product Addons and Product Options With Custom Fields  WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.","status":"published","published":"2026-07-22T06:00:02.525Z","modified":"2026-07-22T13:00:54.333Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-47612","description":"The Product Addons and Product Options With Custom Fields  WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.","status":"published","published":"2026-07-22T06:00:02Z","modified":"2026-07-22T13:00:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:46.900828Z"}],"ghsa":[{"id":"GHSA-m254-gmq9-65xp","title":"The Product Addons and Product Options With Custom Fields  WordPress plugin before 1.6.15 does...","description":"The Product Addons and Product Options With Custom Fields  WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.","status":"published","published":"2026-07-22T09:32:13Z","modified":"2026-07-22T15:32:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:39.270941Z"}],"nvd":[{"id":"CVE-2026-12968","description":"The Product Addons and Product Options With Custom Fields  WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.","status":"published","published":"2026-07-22T07:16:34.71Z","modified":"2026-07-22T16:30:26.533Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:32.089897Z"}]}}