Unknown Admin And Site Enhancements Ase vulnerabilities

3 CVEs affecting Unknown Admin And Site Enhancements Ase, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19615, published 2026-08-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12083, published 2026-07-06. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a…
CVE-2026-19615, published 2026-08-20. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted…
CVE-2025-9487, published 2025-09-22. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a…