CVE-2025-14564: WordPress Media Uploader XSS Vulnerability

CVE-2025-14564 Overview

CVE-2025-14564 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Viable URL Media Uploader plugin for WordPress. The flaw exists in all versions up to and including 1.0.0. It stems from insufficient input sanitization and output escaping when handling Scalable Vector Graphics (SVG) file uploads. Authenticated users with Author-level access or above can upload SVG files containing arbitrary JavaScript. The malicious script executes in the browser of any user who accesses the uploaded SVG file. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with Author privileges can inject persistent JavaScript that executes in visitor and administrator browsers, enabling session hijacking, credential theft, and unauthorized actions on behalf of privileged users.

Affected Products

Viable URL Media Uploader plugin for WordPress — all versions up to and including 1.0.0
Vulnerable component: includes/class-vumu-svg-support.php
WordPress installations permitting Author-level or higher account registration

Discovery Timeline

2026-09-30 - CVE-2025-14564 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-14564

Vulnerability Analysis

The Viable URL Media Uploader plugin extends WordPress to allow SVG uploads through its media handling routines. SVG files are Extensible Markup Language (XML) documents that browsers render natively and that can contain <script> elements or inline event handlers. When the plugin registers SVG support, it does not sanitize inbound file contents or escape output when the file is later served.

An attacker with Author-level access uploads a crafted SVG containing JavaScript payloads. When any authenticated user or site visitor navigates to the SVG URL, the browser parses the XML and executes the embedded script in the origin of the WordPress site. Because the payload persists in the media library, this is a stored XSS with a long dwell time.

Exploitation enables session token theft, forced administrative actions through cross-site request forgery chaining, and injection of secondary payloads served from a trusted origin.

Root Cause

The root cause is the absence of SVG-specific sanitization prior to storing uploaded files, combined with unescaped rendering. The plugin registers the image/svg+xml MIME type without filtering script elements, <foreignObject> blocks, or on* event attributes. Reference implementations such as enshrined/svgSanitize are not applied to the upload path in class-vumu-svg-support.php.

Attack Vector

Exploitation requires an authenticated account with Author role or higher, which lowers but does not eliminate the barrier on sites that allow contributor registration or on multi-author publications. The attack proceeds over the network through the standard WordPress media upload interface. No user interaction is required beyond an eventual browser fetch of the uploaded SVG. Because the impact crosses the security boundary between the file and the containing site origin, the scope changes.

No verified proof-of-concept code has been published. Refer to the Wordfence vulnerability analysis and the WordPress plugin code review for technical details.

Detection Methods for CVE-2025-14564

Indicators of Compromise

SVG files in wp-content/uploads/ containing <script> tags, javascript: URIs, or on* event handler attributes
Media library entries uploaded by Author-level accounts with the image/svg+xml MIME type
Outbound requests from visitor browsers to attacker-controlled domains originating from SVG page loads
New or unexpected Author-level accounts created shortly before SVG uploads

Detection Strategies

Scan the uploads directory for SVG files and grep for XML nodes matching script, foreignObject, iframe, use xlink:href="data:, or on[a-z]+= patterns
Review the wp_posts table for post_mime_type = 'image/svg+xml' entries and correlate with the uploading user role
Enable file integrity monitoring on wp-content/uploads/ to flag newly written .svg files
Deploy a web application firewall rule that inspects multipart uploads for SVG payloads containing executable XML constructs

Monitoring Recommendations

Alert on privilege changes and new Author, Editor, or Administrator account creation
Log all media upload events with associated user, IP address, and file hash
Monitor Content Security Policy (CSP) violation reports for inline script executions on media URLs
Track anomalous authenticated sessions accessing wp-admin from unusual geolocations after SVG uploads

How to Mitigate CVE-2025-14564

Immediate Actions Required

Deactivate and remove the Viable URL Media Uploader plugin until a patched version is available
Audit the media library and delete any SVG files uploaded by non-Administrator accounts
Rotate WordPress session cookies and force password resets for all privileged accounts
Restrict Author-level and higher role assignments to trusted users pending vendor guidance

Patch Information

No patched version has been identified in the enriched CVE data at the time of publication. Monitor the WordPress plugin repository entry and the Wordfence advisory for release information. Until a fixed version is published, treat all versions through 1.0.0 as vulnerable.

Workarounds

Disable SVG uploads entirely by removing image/svg+xml from the WordPress upload_mimes filter allowlist
Serve uploaded SVG files with Content-Disposition: attachment and Content-Security-Policy: default-src 'none' headers to prevent inline execution
Route SVG delivery through a sanitizing proxy or integrate a library such as enshrined/svgSanitize at the upload boundary
Restrict Author-level accounts from uploading files by adjusting role capabilities with a role management plugin

bash

# Remove SVG from allowed WordPress upload MIME types
# Add to functions.php or a site-specific plugin
add_filter( 'upload_mimes', function( $mimes ) {
    unset( $mimes['svg'] );
    unset( $mimes['svgz'] );
    return $mimes;
}, 999 );

# Nginx: force SVG downloads and block inline execution
location ~* \.svgz?$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox";
    add_header X-Content-Type-Options "nosniff";
}