Unrated severityNVD Advisory· Published Nov 7, 2026

CVE-2026-121796

Description

The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Add From Server Litellm-create
Range: <6.0.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/1678486d-97cb-4a31-bb03-ef916f8bf497/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000