CVE Feed

    Dashboard / CVE / CVE-2025-12163

    CVE-2025-12163

    The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

    Published:Dec 5, 2025
    Last Modified:Apr 15, 2026
    EPS:Dec 5, 2025
    EPSS Score:0.00026
    CVSS Score:6.4

    Affected Products

    Vendor
    Omnipressteam
    Product
    Omnipress
    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    https://github.com/SnailSploit/CVE-2025-12163

    References

    https://cwe.mitre.org/data/definitions/434.html
    https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
    https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/Core/RestControllersBase.php#L81
    https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/RestApi/Controllers/V1/FileUploadRestController.php#L57
    https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L106
    https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L85
    https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3415108%40omnipress&new=3415108%40omnipress&sfp_email=&sfph_mail=
    https://www.wordfence.com/threat-intel/vulnerabilities/id/15aabe3b-1b77-4e4e-9710-cf06924dbcbf?source=cve

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High