CVE-2026-12968 – Product Addons – WowAddons < 1.6.15 – Unauthenticated Stored XSS via Arbitrary SVG Upload

CVE ID :CVE-2026-12968

Published : July 22, 2026, 7:16 a.m. | 29 minutes ago

Description :The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…