Impact Analysis

This vulnerability can allow authenticated users with upload permissions to execute arbitrary JavaScript in the context of the affected website by uploading malicious SVG files. This can lead to Cross-Site Scripting attacks, which may result in session hijacking, defacement, data theft, or other malicious actions performed on behalf of users who access the malicious SVG files. [1]

Useful 0 Not Useful 0

Executive Summary

CVE-2025-9487 is a medium-severity stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin 'Admin and Site Enhancements' versions before 7.9.8. It occurs because the plugin does not sanitize SVG files uploaded via the xmlrpc.php endpoint when SVG uploads are enabled. This allows authenticated users with upload permissions to upload malicious SVG files containing embedded JavaScript payloads. When these SVG files are accessed, the malicious JavaScript executes, potentially compromising the site or user data. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Admin and Site Enhancements WordPress plugin version is prior to 7.9.8 and if the SVG upload setting is enabled. Additionally, monitoring for POST requests to xmlrpc.php that include base64-encoded SVG files with embedded <script> tags can help identify exploitation attempts. Using tools like Burp Suite to intercept and analyze xmlrpc.php requests can assist in detection. A command example to check plugin version via WP-CLI is: `wp plugin get admin-and-site-enhancements --field=version`. Network monitoring can include searching for POST requests to xmlrpc.php containing SVG uploads. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Admin and Site Enhancements WordPress plugin to version 7.9.8 or later, which contains the fix for this vulnerability. If updating is not immediately possible, disable the SVG upload feature in the plugin settings and restrict upload permissions to trusted users only. Additionally, monitor and block suspicious POST requests to xmlrpc.php that attempt to upload SVG files. [1]

Useful 0 Not Useful 0