All in One Files Upload CVE-2026-85573

Exploitable against default installations of All in One Files Upload versions 2.0.3 up to (not including) 2.0.17, because the plugin itself adds SVG to the site's allowed upload types and exposes public upload requests whose authenticity it does not verify - so no authentication is required (PR:N) and no non-default configuration is needed. The key limiting factor is required user interaction (UI:R): the stored SVG only executes its active content when a victim opens or previews it in a browser, and meaningful impact (site takeover) depends on that victim being a privileged user such as an administrator. Exploitation is not automatable (per SSVC) precisely because of this victim-open requirement.

Signals conflict on how urgent this is. The vendor/NVD CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) frames it as near-critical, but that rating leans on treating a stored-XSS session-takeover chain as full C:H/I:H/A:H against the vulnerable system, which is aggressive for a CWE-79 issue. CISA's SSVC framework tempers this considerably: Exploitation is 'none' (no observed activity), Automatable is 'no' (each attack needs a victim to open the malicious SVG), while Technical Impact is 'total' (a script running in an admin's origin can fully compromise the site). There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so this is a real-but-not-yet-exploited issue rather than an emergency. The genuinely elevated factors are that upload is unauthenticated (PR:N) and low-complexity (AC:L), because the plugin both whitelists SVG and fails to verify the authenticity of its public upload requests. The mitigating factor is UI:R - a victim (ideally an administrator) must actually open the stored SVG for the payload to fire. Net: a legitimate high-priority patch item for affected sites, but the 8.8 overstates it versus typical stored-XSS scoring; my independent assessment is closer to 7.1.

An unauthenticated attacker sends a forged public upload request to the plugin's endpoint and stores an SVG file containing embedded JavaScript, since the plugin whitelists SVG and neither sanitizes the file nor validates the request's authenticity. When an administrator or other victim later opens or previews that SVG, the embedded script executes in the site's origin, enabling session/cookie theft or admin actions that can lead to full site takeover. No public exploit code is identified at time of analysis, though the technique is well understood and low-complexity.