{"id":"CVE-2026-85573","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-85573","generatedAt":"2026-10-28T00:51:05.237Z","title":"The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files…","description":"The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.","published":"2026-09-30T06:17:07.000Z","lastModified":"2026-09-30T16:28:32.000Z","status":"Deferred","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00276,"percentile":0.19833,"date":"2026-10-26","history":[{"date":"2026-09-30","score":0.00172,"percentile":0.05968}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-09-30T16:30:07.000Z","detail":{"from":null,"score":"8.8","severity":"HIGH","fromSeverity":null},"summary":"Now scored CVSS 8.8 HIGH."},{"kind":"new","label":"New CVE","at":"2026-09-30T06:17:07.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-09-30T06:17:06.503Z"},"summary":"New CVE, high severity (CVSS 8.8)."}],"references":[{"url":"https://wpscan.com/vulnerability/0f7f1f25-02e2-49b5-9690-31857e9e6bda/","source":"contact@wpscan.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-85573","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}