CVE-2025-9487 - Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG

Back Back to CVE browser

MEDIUM

Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG

Published Sep 22, 2025

4.7

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads

Affected products

Vendor n/a Product Admin and Site Enhancements (ASE) Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.9.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Admin and Site Enhancements (ASE)

unaffected

Version	Status	Constraints
0	affected	<7.9.8

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30407
Advisory
https://wpscan.com/vulnerability/b957b7c4-7a7c-497e-b8e4-499c821fb1b0/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30407		Advisory
https://wpscan.com/vulnerability/b957b7c4-7a7c-497e-b8e4-499c821fb1b0/		exploitvdb-entrytechnical-description