Admin And Site Enhancements Ase
Monthly
Stored cross-site scripting in the Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 allows authenticated users with site-owner-granted upload access to embed malicious JavaScript inside SVG files uploaded through incompletely sanitized routes, which then executes silently in the browser of any user - including administrators - who subsequently opens or previews the file. The plugin fails to apply SVG sanitization uniformly across all upload-accepting endpoints, meaning at least one route bypasses the intended XSS filter. A publicly available proof-of-concept has been confirmed by WPScan (EUVD-2026-63203), though SSVC assessment and the absence of a CISA KEV entry indicate no active widespread exploitation at time of analysis.
Privilege escalation in the Admin and Site Enhancements (ASE) WordPress plugin (free and Pro) before 8.8.4 lets unauthenticated attackers restore a previously demoted administrator account back to the administrator role, because the role-restoration request handler performs no authentication, authorization, or nonce validation. This is an incomplete-fix regression of CVE-2024-43333 / CVE-2025-24648, which only closed one of the two demotion paths exposed by the WordPress role API. Publicly available exploit code exists (WPScan), though EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Authenticated users with insufficient access control restrictions in Admin and Site Enhancements (ASE) versions 8.4.0 and earlier can bypass authorization checks to read and modify sensitive data. The vulnerability stems from improperly configured access control levels that fail to enforce proper privilege boundaries. An attacker with valid credentials can exploit this to gain unauthorized access to protected functionality without elevated permissions.
Stored cross-site scripting in the Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 allows authenticated users with site-owner-granted upload access to embed malicious JavaScript inside SVG files uploaded through incompletely sanitized routes, which then executes silently in the browser of any user - including administrators - who subsequently opens or previews the file. The plugin fails to apply SVG sanitization uniformly across all upload-accepting endpoints, meaning at least one route bypasses the intended XSS filter. A publicly available proof-of-concept has been confirmed by WPScan (EUVD-2026-63203), though SSVC assessment and the absence of a CISA KEV entry indicate no active widespread exploitation at time of analysis.
Privilege escalation in the Admin and Site Enhancements (ASE) WordPress plugin (free and Pro) before 8.8.4 lets unauthenticated attackers restore a previously demoted administrator account back to the administrator role, because the role-restoration request handler performs no authentication, authorization, or nonce validation. This is an incomplete-fix regression of CVE-2024-43333 / CVE-2025-24648, which only closed one of the two demotion paths exposed by the WordPress role API. Publicly available exploit code exists (WPScan), though EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Authenticated users with insufficient access control restrictions in Admin and Site Enhancements (ASE) versions 8.4.0 and earlier can bypass authorization checks to read and modify sensitive data. The vulnerability stems from improperly configured access control levels that fail to enforce proper privilege boundaries. An attacker with valid credentials can exploit this to gain unauthorized access to protected functionality without elevated permissions.