CVE-2025-4963: WP Extended Plugin XSS Vulnerability

CVE-2025-4963 Overview

CVE-2025-4963 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Extended plugin for WordPress. The flaw affects all plugin versions up to and including 3.0.15. The plugin fails to sanitize input and escape output when handling Scalable Vector Graphics (SVG) file uploads. Authenticated users with Author-level access or higher can inject arbitrary JavaScript into uploaded SVG files. The malicious script executes in the browser of any user who accesses the SVG file. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on May 28, 2025.

Critical Impact
Authenticated Author-level attackers can inject persistent JavaScript through SVG uploads, enabling session theft, account takeover, and administrative actions when victims view the file.

Affected Products

WP Extended plugin for WordPress, all versions up to and including 3.0.15
WordPress sites permitting SVG uploads through the WP Extended SVG upload module
Deployments allowing Author-level or higher account registration

Discovery Timeline

2025-05-28 - CVE-2025-4963 published to the NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4963

Vulnerability Analysis

The vulnerability originates in the SVG file upload feature provided by the WP Extended plugin. SVG is an Extensible Markup Language (XML) based image format that can embed <script> elements, event handlers, and inline JavaScript. The plugin permits SVG uploads without stripping active content or escaping output when the file is served. An authenticated attacker with Author-level access uploads a crafted SVG containing JavaScript payloads. When any user, including administrators, navigates directly to the SVG file URL or previews it within the WordPress dashboard, the browser renders the SVG and executes the embedded script in the origin of the WordPress site.

Because the payload runs in the authenticated user's session context, it can perform actions on behalf of the victim. This includes exfiltrating session cookies, issuing REST API requests, creating administrator accounts, or modifying site content. The scope change reflected in the vulnerability metadata indicates the executed script can affect resources beyond the compromised component. See the Wordfence Vulnerability Report for advisory details.

Root Cause

The plugin does not sanitize the XML structure of uploaded SVG files and does not enforce output escaping when serving them. Active SVG content such as <script>, onload, and onclick attributes is preserved verbatim on disk and returned with an image Multipurpose Internet Mail Extensions (MIME) type. Browsers execute inline JavaScript within SVG documents when rendered directly, which permits the stored payload to run under the site's origin.

Attack Vector

Exploitation requires an authenticated account with Author-level access or above. The attacker uploads an SVG file containing embedded JavaScript through the plugin's SVG upload module. The file is stored in the WordPress media library and served from the site origin. When any user accesses the SVG URL directly, the script executes in that user's browser. Refer to the WP Extended SVG File Upload Guide and the WordPress Plugin Changeset for feature and fix details.

// No verified public exploit code is available.
// The vulnerability is triggered by an SVG file that includes
// active XML content such as inline <script> elements or
// event-handler attributes, which browsers execute when the
// SVG is loaded directly from the WordPress uploads directory.

Detection Methods for CVE-2025-4963

Indicators of Compromise

SVG files under /wp-content/uploads/ containing <script>, onload, onerror, or javascript: strings
Newly created Author-level or higher accounts followed by SVG uploads to the media library
Outbound HTTP requests to unfamiliar domains initiated from administrator browser sessions after viewing media
Unexpected creation of administrator users or modifications to plugin, theme, or wp_options records

Detection Strategies

Scan the wp-content/uploads/ directory for SVG files and grep for active XML tags and event attributes
Review WordPress audit logs for upload_files capability usage by non-administrator roles
Correlate media uploads by newly registered accounts with subsequent administrator session activity
Monitor Content Security Policy (CSP) violation reports for inline script execution originating from the site origin

Monitoring Recommendations

Alert on any SVG upload where the file contains <script, on*= attributes, or xlink:href="javascript:
Track WP Extended plugin version across managed WordPress sites and flag installations at or below 3.0.15
Enable web server access logging for .svg requests and review referrers to detect direct-access exploitation

How to Mitigate CVE-2025-4963

Immediate Actions Required

Update the WP Extended plugin to a version above 3.0.15 that includes the fix from WordPress Plugin Changeset 3300818
Audit all Author-level and higher accounts and remove or reset any that are unrecognized
Inspect the media library and delete SVG files containing embedded scripts or event handlers
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

The vendor addressed the vulnerability in a WP Extended plugin release following version 3.0.15. The corrective changes are recorded in the WordPress Plugin Changeset. Site administrators should apply the update through the WordPress plugin manager and confirm the running version through the WP Extended Developer Resources page.

Workarounds

Disable the SVG upload module within WP Extended until the patched version is installed
Restrict the upload_files capability to trusted roles only and remove SVG from allowed MIME types
Serve SVG files through a sanitization proxy that strips scripts and event handlers before delivery
Deploy a Content Security Policy that blocks inline script execution from the WordPress origin

bash

# Restrict SVG uploads at the web server layer (nginx example)
location ~* \.svg$ {
    add_header Content-Security-Policy "script-src 'none'; object-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}