PULSE
ESPT
FEED
ransomblack x reclama a Forus Deporte y Ocio S.L · ES · Hospitalityransomblack x reclama a DomusVi · ES · Healthcareransomvortex reclama a CRESA · US · Professional Servicesransomvortex reclama a ALEXION · US · Healthcareransomvortex reclama a PYRAMID HEALTHCARE · US · Healthcareransomn0n reclama a Landmark Group · AE · Retail & E-Commerceransomn0n reclama a Vertex Pharmaceuticals Incorporated · US · Healthcareransomiah6477 reclama a fhiworks · Healthcareransomaoqin reclama a Irwin Automotive Group · US · Retail & E-Commerceransomsilentransomgroup reclama a Wilentz, Goldman & Spitzer · Professional Servicesransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerceransomblack x reclama a Forus Deporte y Ocio S.L · ES · Hospitalityransomblack x reclama a DomusVi · ES · Healthcareransomvortex reclama a CRESA · US · Professional Servicesransomvortex reclama a ALEXION · US · Healthcareransomvortex reclama a PYRAMID HEALTHCARE · US · Healthcareransomn0n reclama a Landmark Group · AE · Retail & E-Commerceransomn0n reclama a Vertex Pharmaceuticals Incorporated · US · Healthcareransomiah6477 reclama a fhiworks · Healthcareransomaoqin reclama a Irwin Automotive Group · US · Retail & E-Commerceransomsilentransomgroup reclama a Wilentz, Goldman & Spitzer · Professional Servicesransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerce
← All CVEs
CVE WatchNov 10, 2026

CVE-2026-104676

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a p

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.

Official references
Related CVEs

No related CVEs by CWE or product.