ZION BUILDER · CVE-2026-104676 · Other
NO FIX YET
The Zion Builder WordPress plugin through 3.6.17 stores uploaded SVG files without sanitizing them and serves them from the site's own origin. A logged-in Author or higher can upload an SVG containing JavaScript that runs in the browser of anyone who opens the file.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Zion Builder WordPress plugin version 3.6.17 or earlier where Author-level or higher users can upload files. Exposure depends on who can upload and on visitors opening the uploaded SVG files. Sites without this plugin, or where only trusted administrators upload media, are less exposed.
Not affected if no-author-uploads, plugin-not-installed
Who cares self-hosted, wordpress, zion-builder
Zion Builder plugin is installed and its version is 3.6.17 or earlier in the WordPress plugins screen.No fix yet, per the sources.
The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.