What is GHSA-f6vx-4jff-vwmg?

GHSA-f6vx-4jff-vwmg is a security advisory published by GitHub Security Advisories with High severity. The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the...

Which CVE IDs does GHSA-f6vx-4jff-vwmg cover?

GHSA-f6vx-4jff-vwmg covers the following CVE IDs: CVE-2026-92994. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f6vx-4jff-vwmg?

GHSA-f6vx-4jff-vwmg has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-f6vx-4jff-vwmgHighCVSS 8.8

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-92994 →

📋 Description

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92994
https://wpscan.com/vulnerability/48356bf5-634f-4008-8904-10ab35007e21
https://github.com/advisories/GHSA-f6vx-4jff-vwmg