CVE-2025-13159: Flo Forms WordPress Plugin XSS Vulnerability

CVE-2025-13159 Overview

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via SVG file uploads in all versions up to and including 1.0.43. This vulnerability exists because the plugin allows SVG file uploads through an unauthenticated AJAX endpoint (flo_form_submit) without proper file content validation. Unauthenticated attackers can exploit this flaw to upload malicious SVG files containing JavaScript that executes when an administrator views the uploaded file in the WordPress admin interface, potentially leading to full site compromise.

Critical Impact

Unauthenticated attackers can achieve Stored XSS through malicious SVG uploads, potentially compromising administrator accounts and achieving full WordPress site takeover.

Affected Products

• Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress versions up to and including 1.0.43

Discovery Timeline

• 2025-11-21 - CVE-2025-13159 published to NVD
• 2025-11-21 - Last updated in NVD database

Technical Details for CVE-2025-13159

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from inadequate input validation in the Flo Forms plugin's file upload handling mechanism. The plugin exposes an unauthenticated AJAX endpoint called flo_form_submit that processes form submissions including file uploads. The critical security flaw is that this endpoint accepts SVG files without validating their contents for malicious code.

SVG (Scalable Vector Graphics) files are XML-based and can contain embedded JavaScript through <script> tags, event handlers like onload, or other active content. When an administrator accesses the WordPress admin interface to review uploaded form submissions, the malicious SVG is rendered in the browser context, executing the embedded JavaScript with the administrator's privileges.

The attack requires no authentication, making it particularly dangerous as any external attacker can submit a weaponized form containing a malicious SVG file. The JavaScript payload executes in the context of an authenticated admin session, enabling attackers to perform any action the administrator can, including creating new admin accounts, modifying site content, or injecting backdoors.

Root Cause

The root cause of this vulnerability is the absence of proper file content validation in the flo_form_submit AJAX handler. While the plugin may check file extensions, it fails to sanitize or validate the actual contents of uploaded SVG files. SVG files are unique among image formats because they are XML-based and can contain executable code. The plugin's failure to strip or neutralize potentially dangerous elements within SVG files before storing them allows attackers to persist malicious payloads on the server.

Attack Vector

The attack is network-based and requires no authentication. An attacker crafts a malicious SVG file containing JavaScript code and submits it through a Flo Forms form on the target WordPress site. The malicious file is stored on the server. When an administrator later views the uploaded file through the WordPress admin panel, the embedded JavaScript executes in their browser session.

The attack flow involves:

1. Attacker identifies a WordPress site using Flo Forms plugin version 1.0.43 or earlier
2. Attacker creates an SVG file with embedded malicious JavaScript
3. Attacker submits the SVG through a form using the flo_form_submit AJAX endpoint
4. The malicious SVG is stored on the server without content validation
5. Administrator views form submissions in the WordPress admin interface
6. Browser renders the SVG and executes the embedded JavaScript with admin privileges
7. Attacker achieves session hijacking, privilege escalation, or site compromise

The vulnerability can be exploited by embedding JavaScript within SVG files using various techniques such as script elements, event handlers on SVG elements, or foreign objects. For detailed technical analysis of the vulnerable code paths, see the WordPress FloForms Admin Code, WordPress FloForms Include Code, and WordPress FloForms Public Code.

Detection Methods for CVE-2025-13159

Indicators of Compromise

• Presence of SVG files in WordPress uploads directory containing <script> tags or JavaScript event handlers
• Unusual file uploads through the flo_form_submit AJAX endpoint containing XML/SVG content
• Web server logs showing POST requests to /wp-admin/admin-ajax.php with action parameter flo_form_submit from suspicious IP addresses
• SVG files with embedded javascript: URIs or onload/onerror event attributes

Detection Strategies

• Monitor file uploads to WordPress for SVG files and scan their contents for script elements, event handlers, and embedded JavaScript
• Implement web application firewall (WAF) rules to detect and block SVG files containing potentially malicious XML elements
• Review web server access logs for patterns of form submissions from automated tools or suspicious sources
• Use WordPress security plugins to scan uploaded files for XSS payloads

Monitoring Recommendations

• Enable detailed logging for AJAX requests in WordPress, particularly for form-related endpoints
• Configure file integrity monitoring on the WordPress uploads directory to detect new SVG file additions
• Implement Content Security Policy (CSP) headers to mitigate the impact of any XSS exploitation
• Set up alerts for administrative account changes or suspicious admin panel activity that could indicate compromise

How to Mitigate CVE-2025-13159

Immediate Actions Required

• Update the Flo Forms plugin to a version newer than 1.0.43 that addresses this vulnerability
• Audit existing file uploads for malicious SVG content and remove any suspicious files
• Review WordPress admin accounts for unauthorized users that may have been created through exploitation
• Temporarily disable SVG file uploads through Flo Forms until a patch is applied

Patch Information

Update the Flo Forms – Easy Drag & Drop Form Builder plugin to the latest available version that contains the security fix. Check the official WordPress plugin repository for the patched release. For additional vulnerability details, refer to the Wordfence Vulnerability Report.

Workarounds

• Disable file uploads in Flo Forms configuration until a security patch is available
• Add server-level restrictions to block SVG file uploads through .htaccess or web server configuration
• Implement a WAF rule to sanitize or reject SVG files submitted through the vulnerable endpoint
• Use WordPress file upload security plugins to enforce content type validation and strip potentially malicious elements from uploaded files

# Example .htaccess configuration to block SVG uploads
<FilesMatch "\.svg$">
    Order Allow,Deny
    Deny from all
</FilesMatch>