This vulnerability (CVE-2026-12968) affects the Product Addons and Product Options With Custom Fields WordPress plugin versions prior to 1.6.15. The plugin does not restrict access to a file-upload endpoint and accepts SVG files, which are stored and served inline. An unauthenticated attacker can exploit this by uploading a crafted SVG containing malicious scripts. When a user, such as an administrator, views the SVG, the embedded script executes in their session, resulting in a cross-site scripting (CWE-79) attack.

An attacker can perform unauthenticated file uploads of malicious SVG files that execute arbitrary scripts in the context of users who view the files. This can lead to session hijacking, privilege escalation, or other malicious actions within the affected WordPress site. The vulnerability affects all users who open the malicious SVG, including administrators, increasing the potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file-upload endpoint if possible and avoid opening SVG files uploaded via this plugin. Monitor vendor communications for updates and apply patches promptly once released.