CVE-2026-121796 · Package
NO FIX YET · SEE WHAT TO DO
The Add From Server Lite WordPress plugin before 6.0.0 lets users with the Author role and above upload SVG files that contain JavaScript. When another user views the uploaded file, the script runs in their browser, a stored cross-site scripting attack.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Add From Server Lite plugin before 6.0.0 where Author-level or higher accounts can upload media. The risk is highest on multi-author sites where editors or admins view uploaded media. Sites that do not use the plugin, or that restrict uploads to trusted roles, are less exposed.
Not affected if plugin-not-installed, uploads-restricted-to-trusted-roles, version-6.0.0-or-later
Who cares add-from-server-lite, self-hosted, wordpress
wp-content/plugins/add-from-server-lite/.6.0.0.6.0.0 or later.The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.