CVE-2025-0817: Ncrafts Formcraft XSS Vulnerability

CVE-2025-0817 Overview

CVE-2025-0817 is a Stored Cross-Site Scripting (XSS) vulnerability in the FormCraft plugin for WordPress. The flaw affects all versions up to and including 3.9.11. Unauthenticated attackers can upload malicious Scalable Vector Graphics (SVG) files containing embedded JavaScript. The plugin fails to sanitize input or escape output on SVG uploads, which allows arbitrary script execution when a user accesses the uploaded file. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress sites running vulnerable FormCraft versions, enabling session theft, credential harvesting, and administrative account takeover through victim interaction.

Affected Products

FormCraft Premium WordPress Form Builder plugin (vendor: ncrafts)
All versions up to and including 3.9.11
WordPress sites with SVG upload functionality enabled through FormCraft

Discovery Timeline

2025-02-18 - CVE-2025-0817 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0817

Vulnerability Analysis

The FormCraft plugin accepts SVG file uploads through its form builder functionality. SVG files are XML-based documents that permit embedded <script> tags and event handlers such as onload or onclick. The plugin does not strip or neutralize these script-bearing elements before storing the file. When a browser renders the uploaded SVG directly from the WordPress uploads directory, the embedded JavaScript executes in the site's origin context. The vulnerability requires user interaction because a victim must access the SVG URL, and the impact crosses a security boundary since scripts run under the WordPress domain.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on file uploads. FormCraft does not validate SVG file contents against an allowlist of permitted XML elements and attributes. The plugin also does not enforce a Content-Disposition: attachment header or restrict the MIME type served for uploaded SVG files. Both controls would prevent inline script execution in the browser.

Attack Vector

An unauthenticated attacker crafts an SVG file containing a JavaScript payload inside a <script> element or an event handler attribute. The attacker submits the SVG through a public FormCraft form that accepts file attachments. The file is stored on the server under the WordPress uploads path. The attacker then distributes the direct file URL through phishing, forum links, or embedded content. When an authenticated administrator or other user opens the URL, the script executes in the WordPress origin and can perform actions on behalf of that user, including reading cookies, issuing REST API requests, or planting persistent backdoors.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-0817

Indicators of Compromise

SVG files in the wp-content/uploads/ directory containing <script>, onload, onclick, or onerror attributes
Web server access logs showing direct GET requests to .svg files under uploads paths from external referrers
Unexpected outbound network connections initiated from administrator browser sessions after visiting SVG URLs
New or modified WordPress administrator accounts without a corresponding audit trail

Detection Strategies

Scan the uploads directory for SVG files and inspect XML content for scripting elements using tools such as grep -rEi '<script|on[a-z]+=' wp-content/uploads/
Monitor WordPress audit logs for form submissions containing SVG attachments from unauthenticated sessions
Enable web application firewall (WAF) rules that inspect uploaded file bodies for embedded JavaScript patterns

Monitoring Recommendations

Alert on any SVG file served from WordPress with a Content-Type: image/svg+xml response header that lacks Content-Security-Policy restrictions
Track administrator session activity for anomalous REST API calls following visits to /wp-content/uploads/*.svg URLs
Correlate file upload events with subsequent privileged actions such as user creation or plugin installation

How to Mitigate CVE-2025-0817

Immediate Actions Required

Update FormCraft to a version later than 3.9.11 once the vendor publishes a fix; review the FormCraft Change Log for release status
Disable SVG uploads in FormCraft form configurations until a patched version is deployed
Audit the wp-content/uploads/ directory for existing SVG files and remove any containing script elements or event handlers
Rotate credentials and session tokens for any administrator who may have accessed a malicious SVG URL

Patch Information

As of the last NVD update on 2026-06-17, no fixed version has been documented in the CVE record. Site operators should monitor the FormCraft Change Log and the CodeCanyon plugin page for security releases. Apply the update immediately upon availability.

Workarounds

Remove SVG from the list of accepted file extensions in FormCraft form settings
Configure the web server to force SVG downloads with Content-Disposition: attachment instead of inline rendering
Deploy a Content Security Policy that blocks inline script execution site-wide
Route uploaded SVG files through a sanitizer such as svg-sanitizer before they are served to browsers

bash

# Nginx configuration to force SVG download instead of inline rendering
location ~* ^/wp-content/uploads/.*\.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "script-src 'none'; object-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}