What is GHSA-c54q-hhx6-vc6r?

GHSA-c54q-hhx6-vc6r is a security advisory published by GitHub Security Advisories with High severity. The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload...

Which CVE IDs does GHSA-c54q-hhx6-vc6r cover?

GHSA-c54q-hhx6-vc6r covers the following CVE IDs: CVE-2026-85573. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c54q-hhx6-vc6r?

GHSA-c54q-hhx6-vc6r has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-c54q-hhx6-vc6rHighCVSS 8.8

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-85573 →

📋 Description

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85573
https://wpscan.com/vulnerability/0f7f1f25-02e2-49b5-9690-31857e9e6bda
https://github.com/advisories/GHSA-c54q-hhx6-vc6r