CVE-2025-12163

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12163", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-24T14:04:10.223Z", "datePublished": "2025-12-05T05:31:21.763Z", "dateUpdated": "2026-04-08T16:36:59.977Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:59.977Z"}, "affected": [{"vendor": "omnipressteam", "product": "Omnipress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "title": "Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15aabe3b-1b77-4e4e-9710-cf06924dbcbf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/RestApi/Controllers/V1/FileUploadRestController.php#L57"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L85"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L106"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/Core/RestControllersBase.php#L81"}, {"url": "https://cwe.mitre.org/data/definitions/434.html"}, {"url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3415108%40omnipress&new=3415108%40omnipress&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2025-12-04T16:31:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T15:21:00.495583Z", "id": "CVE-2025-12163", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T15:22:19.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12163", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T15:21:00.495583Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T15:21:44.517Z"}}], "cna": {"title": "Omnipress <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "omnipressteam", "product": "Omnipress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T16:31:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15aabe3b-1b77-4e4e-9710-cf06924dbcbf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/RestApi/Controllers/V1/FileUploadRestController.php#L57"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L85"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L106"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/Core/RestControllersBase.php#L81"}, {"url": "https://cwe.mitre.org/data/definitions/434.html"}, {"url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"}], "descriptions": [{"lang": "en", "value": "The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-05T05:31:21.763Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12163", "state": "PUBLISHED", "dateUpdated": "2025-12-05T15:22:19.297Z", "dateReserved": "2025-10-24T14:04:10.223Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T05:31:21.763Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Omnipress", "vendor": "omnipressteam", "versions": [{"lessThanOrEqual": "1.6.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}, {"lang": "es", "value": "El plugin Omnipress para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la carga de archivos SVG en todas las versiones hasta la 1.6.3, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con acceso de nivel de Autor y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda al archivo SVG."}], "id": "CVE-2025-12163", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12163", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T15:21:00.495583Z", "version": "2.0.3"}}]}, "published": "2025-12-05T06:16:06.053", "references": [{"source": "security@wordfence.com", "url": "https://cwe.mitre.org/data/definitions/434.html"}, {"source": "security@wordfence.com", "url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/Core/RestControllersBase.php#L81"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/RestApi/Controllers/V1/FileUploadRestController.php#L57"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L106"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L85"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3415108%40omnipress&new=3415108%40omnipress&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15aabe3b-1b77-4e4e-9710-cf06924dbcbf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:43:27.352098+00:00", "value": {"mitigation_remediation": ["Update Omnipress to the latest patched version, if an update exists.", "Restrict the Author role\u2019s ability to upload SVG files or disable SVG uploads entirely, limiting that permission to administrators only.", "Remove or replace any SVG files that were uploaded before the patch, to eliminate existing malicious content.", "As an additional measure, use a sanitization plugin or configure the server to strip disallowed SVG elements and attributes before serving them."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via SVG uploads"}, "threat_synthesis": {"affected_systems": "All released versions of Omnipress up to and including 1.6.5 are affected. The plugin, distributed under the omnipressteam:Omnipress vendor label, contains the flaw in its core REST API upload handling routines. Administrators or site editors with Author role should treat any current or past SVG uploads as potentially malicious and review or remove them.", "description_and_impact": "The Omnipress plugin for WordPress permits authenticated users with Author\u2011level access to upload SVG files. Because the plugin does not sanitize user\u2011supplied SVG content nor escape output, these files are stored and served unchanged. A malicious SVG containing injected JavaScript or other executable payload will run in the browser of any user who opens the file, satisfying CWE\u201179 and enabling the attacker to execute arbitrary client\u2011side code, steal session cookies, or deface pages on the site.", "risk_and_exploitability": "The CVSS score of 6.4 classifies the vulnerability as medium severity. The EPSS score falls below 1%, indicating that the likelihood of exploitation observed in the wild is very low today, and it is not listed in the CISA KEV catalog. Nonetheless, because the attacker needs only Author\u2011level authentication, an attacker could easily exploit it. The attack vector involves an author logging in, uploading a crafted SVG via the plugin\u2019s file\u2011upload endpoint, and then any site visitor who opens that file will suffer cross\u2011site scripting. The path is purely through the web interface, with no requirement for network\u2011level access."}}}}, "created": "2025-12-05T10:51:56.457348+00:00", "updated": "2026-04-27T22:45:15.492655+00:00", "vendors": ["omnipressteam", "omnipressteam$PRODUCT$omnipress", "wordpress", "wordpress$PRODUCT$wordpress"]}