{"affected":[{"defaultStatus":"unknown","product":"Zion Builder","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"3.6.17","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-104676","cwes":["CWE-79"],"description":"The Zion Builder  WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/c7f45006-a654-4d3f-83b0-727e468f487e/"}],"kev":null,"metrics":[],"modifiedAt":1794290404271,"publishedAt":1794290404271,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/c7f45006-a654-4d3f-83b0-727e468f487e/"}],"remediation":[],"revision":"8471dca4c269b046790efa61c0c6c7e6b9147e828bb50df93734ea2d185da3e3","sources":[{"modifiedAt":1794290404271,"name":"CNA: WPScan","retrievedAt":1794290900245,"url":"https://www.cve.org/CVERecord?id=CVE-2026-104676"}],"ssvc":null,"status":"published","title":"Zion Builder <= 3.6.17 - Author+ Stored XSS via SVG Upload","updatedAt":1794290900245}