CVE-2025-12880: Progress Bar Blocks Gutenberg Plugin XSS

CVE-2025-12880 Overview

CVE-2025-12880 is a stored cross-site scripting (XSS) vulnerability in the Progress Bar Blocks for Gutenberg plugin for WordPress. The flaw affects all versions up to and including 1.0.0. It stems from insufficient input sanitization and output escaping during Scalable Vector Graphics (SVG) file uploads. Authenticated users with Author-level access or higher can upload SVG files containing embedded scripts. Those scripts execute in the browser of any visitor who accesses the SVG file. The issue is tracked under CWE-79 and was published to the National Vulnerability Database on November 11, 2025.

Critical Impact
Authenticated attackers with Author privileges can inject arbitrary JavaScript through SVG uploads, leading to session theft, account takeover, or redirection of site visitors.

Affected Products

Progress Bar Blocks for Gutenberg (WordPress plugin) — all versions through 1.0.0
WordPress sites permitting SVG uploads by Author-level and higher accounts
Downstream site visitors who render the uploaded SVG assets

Discovery Timeline

2025-11-11 - CVE-2025-12880 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12880

Vulnerability Analysis

The Progress Bar Blocks for Gutenberg plugin allows authenticated users to upload SVG files without adequately stripping executable content. SVG is an XML-based image format that can embed <script> elements, event handlers such as onload, and foreign objects. When the plugin accepts these files, it stores them on the server and serves them with an image MIME type. Browsers rendering the SVG execute any embedded JavaScript in the origin of the WordPress site. The result is a stored XSS payload persisting until an administrator removes the file.

Exploitation requires an authenticated account at Author level or above and user interaction to view the SVG. Because the payload runs in the site's origin, it can access cookies, session tokens, and administrative interfaces reachable by the victim's browser.

Root Cause

The plugin does not sanitize SVG content before storage and does not escape or restrict output when the file is retrieved. WordPress core does not perform deep sanitization of SVG uploads, so plugins that add SVG support must implement their own filtering. The absence of that filtering allows script-bearing SVGs to be uploaded and served intact.

Attack Vector

An attacker authenticates to a vulnerable WordPress site using an Author-level account. The attacker crafts an SVG file containing an embedded script payload, such as a <script> block or an onload handler on an SVG element. The attacker uploads the file through the media library or the plugin's block interface. When any user, including an administrator, opens the direct URL of the SVG file, the browser parses the XML and executes the script in the site's origin.

Code examples are not published for this issue. Refer to the Wordfence Vulnerability Report for further technical detail.

Detection Methods for CVE-2025-12880

Indicators of Compromise

SVG files in wp-content/uploads/ containing <script> tags, javascript: URIs, or event handlers such as onload, onerror, or onclick
New media library entries with .svg extensions uploaded by Author-level accounts
Outbound requests from site visitors' browsers to attacker-controlled domains after viewing plugin-managed content
Unexpected administrative actions performed shortly after an administrator viewed a page containing an uploaded SVG

Detection Strategies

Scan the uploads directory for SVG files and inspect their XML for scripting constructs
Review WordPress audit logs for SVG uploads originating from non-administrator accounts
Compare installed plugin versions against the fixed release once published by the vendor

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ to flag new SVG files
Log and alert on media uploads by users with Author or Contributor roles
Monitor Content Security Policy (CSP) violation reports for inline script executions on media URLs

How to Mitigate CVE-2025-12880

Immediate Actions Required

Disable or remove the Progress Bar Blocks for Gutenberg plugin until a patched release is available
Audit existing SVG uploads and remove any files containing scripts or event handlers
Restrict SVG upload capability to trusted administrator accounts only
Rotate credentials for administrators who may have viewed malicious SVG content

Patch Information

At the time of publication, no fixed version has been listed in the NVD record. Monitor the WordPress Plugin Page and the Wordfence Vulnerability Report for a release addressing CVE-2025-12880. Apply the update as soon as it is available and verify the plugin version after upgrade.

Workarounds

Block SVG uploads at the web server or WordPress filter level using an upload_mimes restriction
Serve uploaded SVG files with Content-Disposition: attachment to prevent inline browser rendering
Deploy a Content Security Policy that disallows inline scripts on media URLs
Use a WordPress security plugin or web application firewall rule to sanitize SVG files at upload time

bash

# Remove SVG from allowed upload MIME types via functions.php
add_filter('upload_mimes', function($mimes) {
    unset($mimes['svg']);
    unset($mimes['svgz']);
    return $mimes;
});