WordPress plugin
Admin and Site Enhancements (ASE) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 12 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium8
- Low1
All Admin and Site Enhancements (ASE) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting <9.0.1Update to 9.0.1 | CVE-2026-19615 | |
| Medium5.3 | Missing Authorization ≤8.8.3Update to 8.8.4 | CVE-2026-12083 | |
| Medium4.3 | Missing Authorization ≤8.4.0Update to 8.4.1 | CVE-2026-32423 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤7.6.2.1Update to 7.6.3 | CVE-2025-24648 | |
| Medium4.3 | Missing Authorization ≤8.0.8Update to 8.1.0 | CVE-2025-64255 | |
| Medium5.4 | Authenticated (Author+) Stored Cross-Site Scripting via SVG ≤7.9.7Update to 7.9.8 | CVE-2025-9487 | |
| Medium5.3 | Password Protection Bypass ≤7.6.9Update to 7.6.10 | CVE-2024-13688 | |
| Medium5.3 | IP Spoofing to Limit Login Attempt Bypass ≤7.6.9Update to 7.6.10 | CVE-2024-13685 | |
| High7.5 | Authenticated (Subscriber+) Privilege Escalation ≤7.6.2.1Update to 7.6.3 | CVE-2024-43333 | |
| Low3.1 | Missing Authorization ≤7.6.2Update to 7.6.3 | CVE-2025-24649 | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting via SVG ≤7.5.1Update to 7.5.2 | CVE-2024-10790 | |
| High7.5 | Password Protection Mode Security Feature Bypass ≤5.7.1Update to 5.8.0 | CVE-2023-46630 |
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
<9.0.1Update to 9.0.1
- Medium5.3Missing Authorization
≤8.8.3Update to 8.8.4
- Medium4.3Missing Authorization
≤8.4.0Update to 8.4.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤7.6.2.1Update to 7.6.3
- Medium4.3Missing Authorization
≤8.0.8Update to 8.1.0
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
≤7.9.7Update to 7.9.8
- Medium5.3Password Protection Bypass
≤7.6.9Update to 7.6.10
- Medium5.3IP Spoofing to Limit Login Attempt Bypass
≤7.6.9Update to 7.6.10
- High7.5Authenticated (Subscriber+) Privilege Escalation
≤7.6.2.1Update to 7.6.3
- Low3.1Missing Authorization
≤7.6.2Update to 7.6.3
- Medium5.4Authenticated Stored Cross-Site Scripting via SVG
≤7.5.1Update to 7.5.2
- High7.5Password Protection Mode Security Feature Bypass
≤5.7.1Update to 5.8.0
Admin and Site Enhancements (ASE): common questions
Does Admin and Site Enhancements (ASE) have known vulnerabilities?
Yes. VulnCrest Radar lists 12 known vulnerabilities in Admin and Site Enhancements (ASE): 3 high, 8 medium, 1 low. None are known to affect version null.
How do I check which version of Admin and Site Enhancements (ASE) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Admin and Site Enhancements (ASE) vulnerability?
CVE-2026-19615, published Aug 21, 2026: Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Admin and Site Enhancements (ASE) vulnerability listed in CISA KEV?
No. None of the known Admin and Site Enhancements (ASE) vulnerabilities is currently listed in the CISA KEV catalog.