CVE-2026-12968
High
Description
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
SeverityHigh
CVSS8.8
Exploit probability43. percentile0.5%
ProductProduct Addons and Product Options With Custom Fields
PublishedJul 22, 2026
First seenJul 22, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Product Addons and Product Options With Custom Fields1.6.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Product Addons and Product Options With Custom Fields | v < 1.6.15 | 1.6.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.