EUVD-2026-47612
GHSA-m254-gmq9-65xp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated upload gives PR:N and AC:L, but the payload needs an admin to open the file (UI:R); admin-session hijack yields C:H/I:H while pure XSS causes no availability loss (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
AnalysisAI
Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target site run the Product Addons and Product Options With Custom Fields plugin below 1.6.15 with its unauthenticated file-upload endpoint reachable, and that the endpoint accept and store SVG files served inline (image/svg+xml rendered in-browser rather than forced download) - these are the concrete preconditions named in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward a genuine priority for exposed WooCommerce stores. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker crafts an SVG containing embedded JavaScript and POSTs it to the plugin's open upload endpoint, receiving a stored, inline-served URL. The attacker then lures a logged-in administrator to open that URL (via a support message, order note, or direct link); when the admin's browser renders the SVG, the script runs in the WordPress admin origin and can create rogue admin accounts, exfiltrate cookies/nonces, or plant a backdoor. … |
| Remediation | Vendor-released patch: upgrade the Product Addons and Product Options With Custom Fields plugin to version 1.6.15 or later, which is the primary and complete fix (see the WPScan advisory at https://wpscan.com/vulnerability/8ae2ff84-a4a0-4fb1-842b-b3193e673d27/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running this plugin and document their current versions; immediately disable the plugin on any system where an update cannot be deployed the same day. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today