{"id":"CVE-2026-104676","kind":"vulnerability","aliases":["CVE-2026-104676"],"related":[],"title":"Zion Builder WordPress plugin: uploaded SVG files run JavaScript in visitors' browsers","description":"The Zion Builder  WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.","summary":"The Zion Builder WordPress plugin through 3.6.17 stores uploaded SVG files without sanitizing them and serves them from the site's own origin. A logged-in Author or higher can upload an SVG containing JavaScript that runs in the browser of anyone who opens the file.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zion Builder","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","self-hosted","wordpress","zion-builder"],"not_affected_if":["no-author-uploads","plugin-not-installed"],"how_to_check":"- Check whether the `Zion Builder` plugin is installed and its version is `3.6.17` or earlier in the WordPress plugins screen.\n- Check whether users with the Author role or above can upload media files on the site.","fix":null,"status":"open","published_at":"2026-11-10T06:17:07+00:00","first_seen_at":"2026-11-10T06:20:22+00:00","triaged_at":"2026-11-10T06:22:25+00:00","updated_at":"2026-11-10T06:22:25+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T06:22:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Zion Builder WordPress plugin: uploaded SVG files run JavaScript in visitors' browsers","impact":"medium","summary":"The Zion Builder WordPress plugin through 3.6.17 stores uploaded SVG files without sanitizing them and serves them from the site's own origin. A logged-in Author or higher can upload an SVG containing JavaScript that runs in the browser of anyone who opens the file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","zion-builder","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs JavaScript in visitors' browsers on the site's origin","analyst_note":"Find the fixed version of Zion Builder and the vendor advisory; the sources give no fix version.","how_to_check":"- Check whether the `Zion Builder` plugin is installed and its version is `3.6.17` or earlier in the WordPress plugins screen.\n- Check whether users with the Author role or above can upload media files on the site.\n- unknown for a fixed version: the sources do not say.","plain_action":"","product_name":"Zion Builder","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-author-uploads"],"who_is_affected":"Sites running the Zion Builder WordPress plugin version 3.6.17 or earlier where Author-level or higher users can upload files. Exposure depends on who can upload and on visitors opening the uploaded SVG files. Sites without this plugin, or where only trusted administrators upload media, are less exposed.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000767,"input_tokens":4568,"output_tokens":621,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104676':15A,18A '-2026':14A,17A '3.6.17':35B,82C 'access':99C 'allow':110C 'anyon':71B,132C 'authent':111C 'author':56B,115C 'browser':12A,69B,130C 'builder':2A,20A,28B,31B,78C 'contain':63B,124C 'content':92C 'craft':122C 'cve':13A,16A 'execut':127C 'file':7A,39B,75B,88C,136C 'higher':58B 'host':24B 'javascript':9A,64B,125C 'locat':100C 'log':54B 'logged-in':53B 'open':73B,134C 'origin':51B,109C 'plugin':4A,33B,80C 'public':98C 'role':116C 'run':8A,66B 'sanit':41B,85C 'self':23B 'self-host':22B 'serv':44B,102C 'site':48B,106C 'store':36B,94C 'svg':6A,38B,62B,87C,123C 'upload':5A,37B,60B,86C,120C 'user':112C 'valid':90C 'visitor':11A 'without':40B 'wordpress':3A,25B,32B,79C 'zion':1A,19A,27B,30B,77C 'zion-build':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Zion Builder WordPress plugin version 3.6.17 or earlier where Author-level or higher users can upload files. Exposure depends on who can upload and on visitors opening the uploaded SVG files. Sites without this plugin, or where only trusted administrators upload media, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["builder","zionbuilder"],"ptokens":["builder","zion"],"labels":["medium","other","selfhosted","vendor","wordpress","zionbuilder"],"campaign_type":null,"search_a":"'-104676':15A,18A '-2026':14A,17A 'browser':12A 'builder':2A,20A 'cve':13A,16A 'file':7A 'javascript':9A 'plugin':4A 'run':8A 'svg':6A 'upload':5A 'visitor':11A 'wordpress':3A 'zion':1A,19A","search_b":"'3.6.17':35B 'anyon':71B 'author':56B 'browser':69B 'builder':28B,31B 'contain':63B 'file':39B,75B 'higher':58B 'host':24B 'javascript':64B 'log':54B 'logged-in':53B 'open':73B 'origin':51B 'plugin':33B 'run':66B 'sanit':41B 'self':23B 'self-host':22B 'serv':44B 'site':48B 'store':36B 'svg':38B,62B 'upload':37B,60B 'without':40B 'wordpress':25B,32B 'zion':27B,30B 'zion-build':26B","search_c":"'3.6.17':82C 'access':99C 'allow':110C 'anyon':132C 'authent':111C 'author':115C 'browser':130C 'builder':78C 'contain':124C 'content':92C 'craft':122C 'execut':127C 'file':88C,136C 'javascript':125C 'locat':100C 'open':134C 'origin':109C 'plugin':80C 'public':98C 'role':116C 'sanit':85C 'serv':102C 'site':106C 'store':94C 'svg':87C,123C 'upload':86C,120C 'user':112C 'valid':90C 'wordpress':79C 'zion':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104676","severity":null,"published_at":"2026-11-10T06:17:07+00:00","modified_at":"2026-11-10T06:17:07+00:00","first_seen_at":"2026-11-10T06:20:22+00:00","fetched_at":"2026-11-10T06:20:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}