XSS Vulnerability in Admin and Site Enhancements Plugin for WordPress
CVE-2025-9487
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 September 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-9487?
The Admin and Site Enhancements (ASE) plugin for WordPress versions before 7.9.8 lacks proper sanitization when handling SVG file uploads through xmlrpc.php. This oversight can allow malicious users to upload SVG files that contain harmful XSS payloads, posing a significant risk to site integrity and user security.
Affected Version(s)
Admin and Site Enhancements (ASE) 0 < 7.9.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.