PULSE
ENPT
FEED
ransomblack x reclama a Forus Deporte y Ocio S.L · ES · Hospitalityransomblack x reclama a DomusVi · ES · Healthcareransomvortex reclama a CRESA · US · Professional Servicesransomvortex reclama a ALEXION · US · Healthcareransomvortex reclama a PYRAMID HEALTHCARE · US · Healthcareransomn0n reclama a Landmark Group · AE · Retail & E-Commerceransomn0n reclama a Vertex Pharmaceuticals Incorporated · US · Healthcareransomiah6477 reclama a fhiworks · Healthcareransomaoqin reclama a Irwin Automotive Group · US · Retail & E-Commerceransomsilentransomgroup reclama a Wilentz, Goldman & Spitzer · Professional Servicesransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerceransomblack x reclama a Forus Deporte y Ocio S.L · ES · Hospitalityransomblack x reclama a DomusVi · ES · Healthcareransomvortex reclama a CRESA · US · Professional Servicesransomvortex reclama a ALEXION · US · Healthcareransomvortex reclama a PYRAMID HEALTHCARE · US · Healthcareransomn0n reclama a Landmark Group · AE · Retail & E-Commerceransomn0n reclama a Vertex Pharmaceuticals Incorporated · US · Healthcareransomiah6477 reclama a fhiworks · Healthcareransomaoqin reclama a Irwin Automotive Group · US · Retail & E-Commerceransomsilentransomgroup reclama a Wilentz, Goldman & Spitzer · Professional Servicesransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerce
← Todos los CVEs
CVE Watch10 nov 2026

CVE-2026-104676

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a p

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 10 nov 2026 · Última mod.: 10 nov 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.