Stored Cross-Site Scripting Vulnerability in Omnipress Plugin for WordPress

CVE-2025-12163

What is CVE-2025-12163?

The Omnipress plugin for WordPress has a vulnerability that allows an attacker with Author-level access or higher to exploit insufficient input sanitization. This security issue arises from the handling of SVG file uploads, permitting the injection of arbitrary scripts into web pages. When users access these manipulated SVG files, the injected scripts can execute in their browsers, compromising the integrity of their sessions and sensitive data.

References