Admin and Site Enhancements (ASE), CVE-2025-9487
- CVE, Research URL
- Home page URL
- Application
- Published on
- Sep 22, 2025
- Research Description
- The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
- Affected versions
-
max 7.9.8.
- Status
-
vulnerable
| Previous vulnerability researches |
|---|
| Web Application Firewall – website security (CVE-2022-4539) , Sep 02, 2024 |
| Web Application Firewall – website security (CVE-2024-2172) , Jun 07, 2024 |