What’s Vulnerable › Vulnerabilities
CVE-2025-9487: Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-22 · updated 2026-06-17
Description
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
Affected products
- Admin and Site Enhancements (ASE): before 7.9.8 — fixed in 7.9.8
How to fix
Upgrade to a fixed version: Admin and Site Enhancements (ASE) 7.9.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-9487 or the next vulnerability affects your stack