CVE-2025-12163
BaseFortify
Publication date: 2025-12-05
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| omnipress | omnipress_wordpress_plugin | 1.6.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Omnipress plugin for WordPress. It occurs because the plugin does not properly sanitize or escape SVG file uploads. Authenticated users with Author-level access or higher can upload malicious SVG files containing harmful scripts. These scripts then execute in the browsers of users who view the affected pages, potentially compromising their security.
How can this vulnerability impact me? :
The vulnerability can allow attackers with Author-level access to inject malicious scripts into SVG files that are stored and later executed in users' browsers. This can lead to unauthorized actions such as stealing user session data, defacing websites, or performing actions on behalf of other users without their consent, thereby compromising the security and integrity of the affected WordPress site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of CVE-2025-12163 on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows authenticated users to upload SVG files containing stored cross-site scripting (XSS), it could potentially lead to unauthorized access or exposure of sensitive data, which may affect compliance with data protection regulations. No direct statements or analysis regarding compliance impact are available in the provided text.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of CVE-2025-12163 involves monitoring for unauthorized or suspicious SVG file uploads via the Omnipress WordPress plugin REST API endpoints. Since the vulnerability allows authenticated users with Author-level access and above to upload SVG files containing malicious scripts, you can detect it by inspecting HTTP POST requests to the plugin's file upload REST endpoint for SVG files. Commands to detect such activity could include using web server logs or network traffic analysis tools to filter POST requests containing SVG uploads. For example, using grep on web server logs: `grep 'POST' /var/log/apache2/access.log | grep 'svg'` or using tools like Wireshark or tcpdump to capture and filter HTTP POST requests with SVG content. Additionally, scanning the upload directories for recently added SVG files and inspecting their content for embedded scripts can help detect exploitation attempts. However, no specific commands are provided in the resources. [2, 4, 5]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restricting or disabling SVG file uploads via the Omnipress plugin until a patch is applied, as SVG uploads are the vector for the stored XSS vulnerability. 2) Ensuring that only trusted users with appropriate capabilities (upload_files) can upload files. 3) Applying strict validation and sanitization of uploaded files, especially SVGs, to remove any embedded scripts or disallow SVG uploads entirely. 4) Updating the Omnipress plugin to a version beyond 1.6.3 once a fix is released. 5) Configuring the web server to prevent execution of uploaded files and to serve SVG files with appropriate Content Security Policies to mitigate script execution. 6) Monitoring and scanning uploaded files for malicious content. These steps align with best practices for preventing unrestricted file upload vulnerabilities and stored XSS attacks. [4, 5]