All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
high
The all-in-one-files-upload-for-woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 2.0.3 to 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wi...
- CVSS:
- 7.2
(Wordfence)
- Affected:
- 2.0.3 – 2.0.16
- Fixed in:
- 2.0.17
- Disclosed:
- Sep 28, 2026
CVE-2026-85573 on NVD →
All in One Files Upload for WooCommerce <= 2.0.16 - Missing Authorization
medium
The All in One Files Upload for WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.16. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin settin...
- CVSS:
- 4.3
(Wordfence)
- Affected:
- up to 2.0.16
- Fixed in:
- 2.0.17
- Disclosed:
- Sep 28, 2026
CVE-2026-85576 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database