Security Advisory

CVE-2026-12968

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-22 06:00:02

Last updated 2026-07-22 13:00:54

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

← Browse all CVEs View on cve.org ↗