CVE-2026-12968
Description
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Metadata
Severity & Metrics
No CVSS data available.
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Unknown | Product Addons and Product Options With Custom Fields | — | 0 < 1.6.15 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| — | cna | CWE-79 Cross-Site Scripting (XSS) |