[ CVE-2026-85573 · Published 30 Sep 2026 ]
Vulnerability in Unknown All in One Files Upload
CVSS 8.8
EPSS <1%No fix listed yet
[ Description ]Official description
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.