What is CVE-2026-12968?
CVE-2026-12968 is an unauthenticated file upload vulnerability in the 'Product Addons and Product Options With Custom Fields' WordPress plugin before version 1.6.15. An attacker can upload a malicious SVG file with embedded scripts, leading to Stored XSS. Update the plugin to the latest version immediately.
Azərbaycanca: CVE-2026-12968 'Product Addons and Product Options With Custom Fields' WordPress plagininin 1.6.15-dən əvvəlki versiyalarında autentifikasiya olunmamış fayl yükləmə zəifliyidir. Təcavüzkar xüsusi hazırlanmış SVG faylı yükləyərək istifadəçi brauzerində skript işlədə bilər. Plagini dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which versions of the WordPress plugin are affected by CVE-2026-12968?
The vulnerability affects the 'Product Addons and Product Options With Custom Fields' plugin prior to version 1.6.15.
What type of attack can be carried out through the CVE-2026-12968 vulnerability?
An attacker can upload a malicious SVG file with embedded scripts, leading to a Stored XSS attack.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.