---
id: "CVE-2026-121796"
page: "https://infrastack.ai/live/CVE-2026-121796"
kind: "vulnerability"
aliases: ["CVE-2026-121796"]
title: "Add From Server Lite WordPress plugin: Author users can upload stored-XSS SVG files"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["add-from-server-lite", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "uploads-restricted-to-trusted-roles", "version-6.0.0-or-later"]
published_at: "2026-11-07T06:16:58+00:00"
first_seen_at: "2026-11-07T06:46:04+00:00"
updated_at: "2026-11-07T06:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121796", "first_seen_at": "2026-11-07T06:46:04+00:00"}]
exploit_sources: []
---

# Add From Server Lite WordPress plugin: Author users can upload stored-XSS SVG files

Link for people: https://infrastack.ai/live/CVE-2026-121796 (this .md is for agents)

The Add From Server Lite WordPress plugin before 6.0.0 lets users with the Author role and above upload SVG files that contain JavaScript. When another user views the uploaded file, the script runs in their browser, a stored cross-site scripting attack.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Add From Server Lite plugin in the WordPress admin under Plugins, or in the plugin's header in `wp-content/plugins/add-from-server-lite/`.
- Flag any version below `6.0.0`.

## Fix

- Update the Add From Server Lite plugin to `6.0.0` or later.

## Timeline

- 2026-11-07T06:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121796

## From the sources

The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_