---
id: CVE-2026-85573
title: >-
  The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the
  site's allowed upload types and does not sanitise uploaded files or verify the
  authenticity of its public upload requests, allowing unauthenticated users to
  store…
summary: >-
  The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the
  site's allowed upload types and does not sanitise uploaded files or verify the
  authenticity of its public upload requests, allowing unauthenticated users to
  store…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
product: All in One Files Upload
affected:
  - all_in_one_files_upload >= 2.0.3 < 2.0.17
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T16:28:31.510'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85573'
references:
  - url: 'https://wpscan.com/vulnerability/0f7f1f25-02e2-49b5-9690-31857e9e6bda/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00276
epssPercentile: 0.19895
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-30T13:24:59.209826Z'
ingestedAt: '2026-09-30T06:58:55.553Z'
---

## Overview

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.