Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG and XML File Uploads
- ID
- WPSEC-2026-0141
- Plugin
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg (astra-sites)
- Affected
- all versions before 4.7.8
- Remediation
- Update to 4.7.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg on WPSec AttackSurface
- Fix released
- Published
Description
The Starter Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG and XML file uploads in all versions up to, and including, 4.7.7. This is due to the bundled importer's upload_mimes filter, registered on every wp-admin request (including the media uploader) for every logged-in user rather than only during template imports, adding SVG, SVGZ and XML (as well as JSON) to the allowed upload types without requiring the unfiltered_html capability. XML uploads were not sanitized at all, and the plugin's SVG sanitizer compared the file extension case-sensitively, so files with an upper-case .SVG extension were stored unsanitized. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG or XML files containing malicious scripts to the media library that execute whenever a user accesses the uploaded file.
References
- https://wpsec.com/vuln/WPSEC-2026-0141/
- https://plugins.svn.wordpress.org/astra-sites/tags/4.7.8/
- https://wordpress.org/plugins/astra-sites/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS