Is CVE-2026-19615 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-19615

Description

The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.