{"id":"CVE-2026-104676","published":"2026-11-10T06:17:07.837","lastModified":"2026-11-10T16:28:46.510","description":"The Zion Builder  WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c7f45006-a654-4d3f-83b0-727e468f487e/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}