Admin and Site Enhancements (ASE), CVE-2025-9487

CVE, Research URL: CVE-2025-9487
Home page URL: Security reports for Admin and Site Enhancements (ASE)
Application: Admin and Site Enhancements (ASE)
Published on: Sep 22, 2025
Research Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
Affected versions: max 7.9.8.
Status: vulnerable