CVE-2026-92994 — Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with …
Published: 2026-09-30 · CVSS: 8.8 · CVSS 3.1
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7