All vulnerabilities
CVE-2026-92994

Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

Unknown Verge3D Publishing and E-Commerce
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.13.1Fixed versionCVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

  • 4.13.1Verge3D Publishing and E-CommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.

Text from CVE List

Affected versions 1

  • Verge3D Publishing and E-Commerceaffected: all versions before 4.13.1CVE List

References 1