{"id":"CVE-2026-121796","kind":"vulnerability","aliases":["CVE-2026-121796"],"related":[],"title":"Add From Server Lite WordPress plugin: Author users can upload stored-XSS SVG files","description":"The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.","summary":"The Add From Server Lite WordPress plugin before 6.0.0 lets users with the Author role and above upload SVG files that contain JavaScript. When another user views the uploaded file, the script runs in their browser, a stored cross-site scripting attack.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["add-from-server-lite","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","uploads-restricted-to-trusted-roles","version-6.0.0-or-later"],"how_to_check":"- Check the installed version of the Add From Server Lite plugin in the WordPress admin under Plugins, or in the plugin's header in `wp-content/plugins/add-from-server-lite/`.\n- Flag any version below `6.0.0`.","fix":"- Update the Add From Server Lite plugin to `6.0.0` or later.","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:22+00:00","updated_at":"2026-11-07T06:48:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Add From Server Lite plugin to `6.0.0` or later.","reach":"internet","title":"Add From Server Lite WordPress plugin: Author users can upload stored-XSS SVG files","impact":"medium","summary":"The Add From Server Lite WordPress plugin before 6.0.0 lets users with the Author role and above upload SVG files that contain JavaScript. When another user views the uploaded file, the script runs in their browser, a stored cross-site scripting attack.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","add-from-server-lite","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs scripts in another user's browser session, possibly an admin's.","analyst_note":"","how_to_check":"- Check the installed version of the Add From Server Lite plugin in the WordPress admin under Plugins, or in the plugin's header in `wp-content/plugins/add-from-server-lite/`.\n- Flag any version below `6.0.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-6.0.0-or-later","uploads-restricted-to-trusted-roles"],"who_is_affected":"Sites running the Add From Server Lite plugin before 6.0.0 where Author-level or higher accounts can upload media. The risk is highest on multi-author sites where editors or admins view uploaded media. Sites that do not use the plugin, or that restrict uploads to trusted roles, are less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4212,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121796':18A,21A '-2026':17A,20A '6.0.0':40B,83C 'add':1A,23B,33B,76C 'add-from-server-lit':22B 'allow':91C,96C 'anoth':56B 'attack':74B,114C 'author':7A,45B,100C 'browser':67B 'contain':53B,108C 'cross':71B 'cross-sit':70B 'cve':16A,19A 'file':15A,51B,61B,107C 'host':30B 'html':95C 'javascript':54B,109C 'let':41B 'lite':4A,26B,36B,79C 'packag':27B 'perform':111C 'plugin':6A,38B,81C 'post':93C 'restrict':86C 'role':46B,101C 'run':64B 'script':63B,73B 'self':29B 'self-host':28B 'server':3A,25B,35B,78C 'site':72B 'store':12A,69B,112C 'stored-xss':11A 'svg':14A,50B,87C,106C 'unfilt':94C 'upload':10A,49B,60B,88C,105C 'user':8A,42B,57B,90C,97C 'view':58B 'wordpress':5A,31B,37B,80C 'xss':13A,113C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Add From Server Lite plugin before 6.0.0 where Author-level or higher accounts can upload media. The risk is highest on multi-author sites where editors or admins view uploaded media. Sites that do not use the plugin, or that restrict uploads to trusted roles, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["addfromserverlite","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121796':18A,21A '-2026':17A,20A 'add':1A 'author':7A 'cve':16A,19A 'file':15A 'lite':4A 'plugin':6A 'server':3A 'store':12A 'stored-xss':11A 'svg':14A 'upload':10A 'user':8A 'wordpress':5A 'xss':13A","search_b":"'6.0.0':40B 'add':23B,33B 'add-from-server-lit':22B 'anoth':56B 'attack':74B 'author':45B 'browser':67B 'contain':53B 'cross':71B 'cross-sit':70B 'file':51B,61B 'host':30B 'javascript':54B 'let':41B 'lite':26B,36B 'packag':27B 'plugin':38B 'role':46B 'run':64B 'script':63B,73B 'self':29B 'self-host':28B 'server':25B,35B 'site':72B 'store':69B 'svg':50B 'upload':49B,60B 'user':42B,57B 'view':58B 'wordpress':31B,37B","search_c":"'6.0.0':83C 'add':76C 'allow':91C,96C 'attack':114C 'author':100C 'contain':108C 'file':107C 'html':95C 'javascript':109C 'lite':79C 'perform':111C 'plugin':81C 'post':93C 'restrict':86C 'role':101C 'server':78C 'store':112C 'svg':87C,106C 'unfilt':94C 'upload':88C,105C 'user':90C,97C 'wordpress':80C 'xss':113C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121796","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}