Advisories · Technology

All in One Files Upload.

Every CVE that names All in One Files Upload among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-85576 CVE record

CVSS 4.3 Medium

All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
- All in One Files Upload
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-85573 CVE record

CVSS 8.8 High

All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
- All in One Files Upload
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026