Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
Admin and Site Enhancements - Cross-Site Scripting (XSS) (CVE-2026-19615)
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.
PLUGIN
Admin and Site Enhancements
CVE-2026-19615
Risk Score
Threat Entry
Updated 2026-07-06
Admin and Site Enhancements - Cross-Site Request Forgery (CSRF) (CVE-2026-12083)
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
PLUGIN
Admin and Site Enhancements
CVE-2026-12083
Risk Score
Threat Entry
Updated 2026-06-17
Admin and Site Enhancements - Cross-Site Scripting (XSS) (CVE-2025-9487)
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
PLUGIN
Admin and Site Enhancements
CVE-2025-9487
Risk Score
Threat Entry
Updated 2026-06-17
Admin And Site Enhancements - Security Vulnerability (CVE-2024-13688)
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request
PLUGIN
Admin And Site Enhancements
CVE-2024-13688
Risk Score
Threat Entry
Updated 2026-06-17
Admin And Site Enhancements - Security Vulnerability (CVE-2024-13685)
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
PLUGIN
Admin And Site Enhancements
CVE-2024-13685
Risk Score
Threat Entry
Updated 2026-06-17
Admin and Site Enhancements - Cross-Site Scripting (XSS) (CVE-2024-10790)
The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. This feature must be enabled, and for specific roles in order to be exploitable.
PLUGIN
Admin and Site Enhancements
CVE-2024-10790
Risk Score