CVE-2025-9487

Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG

CVSS 4.7 MEDIUMEPSS 0.2%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 set 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Produtos afetados

Unknown · Admin and Site Enhancements (ASE)

Referências

https://wpscan.com/vulnerability/b957b7c4-7a7c-497e-b8e4-499c821fb1b0/