CVE-2025-14120: URL Image Importer Plugin XSS Vulnerability

CVE-2025-14120 Overview

The URL Image Importer plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious scripts through SVG file uploads. This vulnerability affects all versions up to and including 1.0.7 due to insufficient sanitization of SVG files during the upload process. Attackers with Author-level access or above can upload specially crafted SVG files containing arbitrary JavaScript code that executes whenever any user accesses the malicious SVG file.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, or administrative account compromise.

Affected Products

• URL Image Importer plugin for WordPress versions up to and including 1.0.7
• WordPress installations with the URL Image Importer plugin installed and users with Author-level access or higher

Discovery Timeline

• 2026-01-06 - CVE-2025-14120 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14120

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exploits the plugin's failure to properly sanitize SVG file uploads. SVG files are XML-based vector graphics that can contain embedded JavaScript code within <script> tags or event handler attributes. When the URL Image Importer plugin processes and stores these SVG files without adequate sanitization, the malicious JavaScript becomes persistently stored on the WordPress server.

The vulnerability is particularly concerning because it requires only Author-level privileges to exploit—a common access level granted to content contributors on WordPress sites. Once the malicious SVG is uploaded, any user who subsequently views or interacts with the file will have the embedded script execute in their browser context, making this a potent attack vector for privilege escalation and data exfiltration.

Root Cause

The root cause of this vulnerability lies in the url-image-importer.php file, specifically around line 176 where the plugin handles file uploads. The plugin fails to implement proper sanitization routines for SVG file content, allowing XML elements containing JavaScript to pass through unfiltered. Unlike binary image formats (JPEG, PNG), SVG files can contain active content that browsers will execute, making them a common vector for XSS attacks when not properly handled.

Attack Vector

The attack is network-accessible and requires low-privilege authentication (Author-level). An attacker would:

1. Authenticate to the WordPress site with Author-level credentials
2. Use the URL Image Importer functionality to upload a malicious SVG file containing embedded JavaScript
3. The malicious script is stored persistently on the server
4. When any user (including administrators) accesses the SVG file, the embedded script executes in their browser session

The vulnerability does not require user interaction beyond normal browsing to trigger, and the scope extends beyond the vulnerable component—allowing scripts to potentially access data from other origins or perform actions on behalf of the victim user.

The malicious SVG could contain JavaScript embedded in various forms, such as within <script> elements or through SVG event handlers like onload. When rendered by a browser, this embedded code executes with the privileges of the viewing user. For technical implementation details, see the WordPress Plugin Source Code.

Detection Methods for CVE-2025-14120

Indicators of Compromise

• Presence of SVG files in WordPress uploads directory containing <script> tags or JavaScript event handlers
• Unexpected SVG file uploads in media library from users with Author-level access
• Web server logs showing requests to SVG files with unusual query parameters or referrers
• Browser console errors or unexpected script execution when viewing media library content

Detection Strategies

• Implement file content scanning for SVG uploads to detect embedded JavaScript or event handlers
• Monitor WordPress media library for SVG file uploads and audit their content
• Deploy Web Application Firewall (WAF) rules to inspect and block SVG files containing script elements
• Enable Content Security Policy (CSP) headers to restrict inline script execution

Monitoring Recommendations

• Configure logging for all file uploads through the URL Image Importer plugin
• Set up alerts for SVG file uploads from non-administrative users
• Monitor for unusual user session activity that could indicate session hijacking
• Review access logs for patterns of users accessing SVG files followed by unexpected administrative actions

How to Mitigate CVE-2025-14120

Immediate Actions Required

• Update the URL Image Importer plugin to a version newer than 1.0.7 that includes the security fix
• Audit existing SVG files in the WordPress media library for malicious content
• Restrict SVG file upload capabilities to trusted administrators only
• Consider temporarily disabling the URL Image Importer plugin until patched

Patch Information

A security patch has been released addressing this vulnerability. The fix can be reviewed in the WordPress Change Set Details. Additional information is available in the Wordfence Vulnerability Report.

Workarounds

• Disable SVG file uploads entirely through WordPress configuration until the plugin is updated
• Implement server-side SVG sanitization using libraries that strip JavaScript and event handlers
• Use the WordPress upload_mimes filter to block SVG uploads from non-administrator users
• Deploy a security plugin that scans uploaded files for malicious content

# WordPress configuration to disable SVG uploads (add to wp-config.php or functions.php)
# Remove SVG from allowed upload types until plugin is patched
add_filter('upload_mimes', function($mimes) {
    unset($mimes['svg']);
    unset($mimes['svgz']);
    return $mimes;
});