CVE-2025-12163: WordPress Omnipress Plugin XSS Vulnerability

CVE-2025-12163 Overview

CVE-2025-12163 is a Stored Cross-Site Scripting (XSS) vulnerability in the Omnipress plugin for WordPress. The flaw affects all versions up to and including 1.6.5. The plugin accepts Scalable Vector Graphics (SVG) file uploads without sufficient input sanitization or output escaping. Authenticated attackers with Author-level access or higher can upload crafted SVG files containing arbitrary JavaScript. The injected scripts execute in the browser of any user who accesses the uploaded SVG file. The vulnerability is tracked under CWE-79 and is related to unrestricted file upload patterns described in CWE-434.

Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress sites by uploading malicious SVG files, enabling session hijacking, credential theft, and defacement.

Affected Products

WordPress Omnipress plugin versions 1.0 through 1.6.5
WordPress sites allowing Author-level account registration with the plugin installed
Any WordPress deployment exposing the Omnipress SVG upload REST endpoint

Discovery Timeline

2025-12-05 - CVE-2025-12163 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2025-12163

Vulnerability Analysis

The Omnipress plugin exposes a REST API endpoint that accepts file uploads from authenticated users. SVG files are XML documents that can embed <script> elements and event handlers such as onload or onclick. When the plugin stores an uploaded SVG without stripping executable content, the file is served with the image/svg+xml MIME type. Browsers render the SVG inline and execute any embedded JavaScript in the context of the WordPress site origin.

The REST handler in FileUploadRestController.php passes uploads to the FileUploader class without filtering SVG content. The relevant upload logic in FileUploader.php writes the raw file to the WordPress uploads directory. Because the file resides on the same origin as the WordPress site, injected scripts can read cookies not marked HttpOnly, perform authenticated actions through the WordPress REST API, and modify page content.

Root Cause

The root cause is missing input validation on SVG payloads combined with missing output escaping when the file is served. The plugin trusts the uploader's role check (Author and above) as sufficient authorization. It does not sanitize the SVG XML to remove script elements, foreign object content, or event-handler attributes before persisting the file.

Attack Vector

An attacker first obtains or compromises an account with Author privileges or higher. The attacker then crafts an SVG file containing a <script> block or an element with an inline event handler. The attacker submits the SVG to the plugin's upload endpoint. The file is stored in the WordPress uploads directory and served from the site's own origin. Any visitor, administrator, or editor who opens the SVG URL triggers execution of the embedded JavaScript. The script runs with full access to the WordPress session of the viewing user.

For technical details of the vulnerable code paths, refer to the Omnipress FileUploader source and the Wordfence advisory.

Detection Methods for CVE-2025-12163

Indicators of Compromise

Presence of .svg files in wp-content/uploads/ containing <script> tags, javascript: URIs, or on* event-handler attributes
Unexpected SVG uploads from Author or Contributor accounts in the WordPress media library
Outbound requests from site visitors to attacker-controlled domains originating from SVG asset URLs
WordPress REST API POST requests to Omnipress file upload endpoints with Content-Type: image/svg+xml

Detection Strategies

Scan the uploads directory for SVG files and inspect XML content for script elements and event handlers
Monitor web server access logs for POST requests to /wp-json/omnipress/v1/ upload routes
Review WordPress audit logs for new media uploads by non-administrator accounts
Deploy content security policy (CSP) violation reporting to surface script execution from /wp-content/uploads/ paths

Monitoring Recommendations

Alert on creation of SVG files containing the strings <script, onload=, or onerror= in the uploads directory
Track authentication events for Author and Editor accounts for anomalous upload activity
Monitor browser error telemetry for cross-site script execution tied to SVG asset URLs

How to Mitigate CVE-2025-12163

Immediate Actions Required

Update the Omnipress plugin to a version later than 1.6.5 once a patched release is available
Audit all SVG files in wp-content/uploads/ and remove any containing script elements or event handlers
Review Author, Editor, and Contributor accounts for unauthorized access and reset credentials where suspicious activity exists
Restrict SVG uploads at the WordPress level until a patched version is deployed

Patch Information

The vendor has committed changes referenced in the WordPress plugin changeset. Administrators should install the latest Omnipress release and verify that uploaded SVG content is sanitized server-side. Confirm patch application by uploading a test SVG containing a benign script element and verifying that the content is stripped.

Workarounds

Disable the Omnipress plugin until a fixed version is installed
Block SVG MIME types in WordPress by filtering upload_mimes to remove image/svg+xml
Configure the web server to serve files from wp-content/uploads/ with Content-Disposition: attachment to prevent inline rendering
Enforce a strict Content-Security-Policy header that disallows inline scripts on paths serving user-uploaded content

bash

# Example WordPress filter to disallow SVG uploads
add_filter('upload_mimes', function($mimes) {
    unset($mimes['svg']);
    unset($mimes['svgz']);
    return $mimes;
});