CVE-2025-12457

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12457", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T23:04:21.568Z", "datePublished": "2025-11-18T09:27:40.395Z", "dateUpdated": "2026-04-08T17:26:14.186Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:14.186Z"}, "affected": [{"vendor": "ideastocode", "product": "Enable SVG, WebP, and ICO Upload", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "title": "Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f267a5-012d-4b9a-a59d-9eccb04c557a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/enable-svg-webp-ico-upload/tags/1.1.2/includes/class-svg.php#L21"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396265%40enable-svg-webp-ico-upload&new=3396265%40enable-svg-webp-ico-upload&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sornram Kampeera"}], "timeline": [{"time": "2025-10-18T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-17T20:54:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:11:16.282822Z", "id": "CVE-2025-12457", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:11:24.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12457", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:11:16.282822Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:11:20.863Z"}}], "cna": {"title": "Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads", "credits": [{"lang": "en", "type": "finder", "value": "Sornram Kampeera"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ideastocode", "product": "Enable SVG, WebP, and ICO Upload", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-18T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-17T20:54:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f267a5-012d-4b9a-a59d-9eccb04c557a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/enable-svg-webp-ico-upload/tags/1.1.2/includes/class-svg.php#L21"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396265%40enable-svg-webp-ico-upload&new=3396265%40enable-svg-webp-ico-upload&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:14.186Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12457", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:14.186Z", "dateReserved": "2025-10-28T23:04:21.568Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T09:27:40.395Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Enable SVG, WebP, and ICO Upload", "vendor": "ideastocode", "versions": [{"lessThanOrEqual": "1.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}, {"lang": "es", "value": "El plugin Enable SVG, WebP, and ICO Upload para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de cargas de archivos SVG en todas las versiones hasta la versi\u00f3n 1.1.2, inclusive, debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda al archivo SVG."}], "id": "CVE-2025-12457", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12457", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T21:11:16.282822Z", "version": "2.0.3"}}]}, "published": "2025-11-18T10:15:47.703", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/enable-svg-webp-ico-upload/tags/1.1.2/includes/class-svg.php#L21"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396265%40enable-svg-webp-ico-upload&new=3396265%40enable-svg-webp-ico-upload&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f267a5-012d-4b9a-a59d-9eccb04c557a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:32:07.694329+00:00", "value": {"mitigation_remediation": ["Upgrade the Enable SVG, WebP, and ICO Upload plugin to version\u00a01.1.3 or newer where the input sanitization bug has been fixed.", "If an upgrade cannot be performed immediately, disable or uninstall the plugin to block further SVG uploads, or configure upload restrictions so that only trusted administrators can upload media.", "Search the media library for previously uploaded SVG files, remove any that appear malicious, and review recent upload logs for suspicious activity."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via SVG uploads"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed versions of the Enable SVG, WebP, and ICO Upload plugin up to and including 1.1.2 are affected. Any site using this plugin in that version range and that permits Author\u2011level users to upload SVG files is vulnerable.", "description_and_impact": "The Enable SVG, WebP, and ICO Upload WordPress plugin contains a stored cross\u2011site scripting flaw that arises from insufficient sanitization of SVG file uploads. Authenticated users with Author privileges or higher can embed malicious scripts into an SVG file, and the script will run in the browsers of any visitor who opens the SVG. This enables attackers to execute arbitrary code in the context of site visitors, potentially leading to session hijacking, credential theft, or defacement of site content.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1\u202f%, suggesting a low likelihood of exploitation so far. It is not listed in the CISA KEV catalog. Exploitation requires only an existing Author\u2011level account and the ability to upload a crafted SVG file, making the attack fairly straightforward once the plugin is present and the user can upload files."}}}}, "created": "2025-11-19T10:48:07.241433+00:00", "updated": "2026-04-21T01:45:24.433685+00:00", "vendors": ["ideastocode", "ideastocode$PRODUCT$enable_svg,_webp_&_ico_upload", "wordpress", "wordpress$PRODUCT$wordpress"]}