Stored XSS Vulnerability in Enable SVG, WebP, and ICO Upload Plugin for WordPress
CVE-2025-12457

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Enable Svg, Webp, And Ico Upload
Vendor
CVE Published:
18 November 2025

What is CVE-2025-12457?

The Enable SVG, WebP, and ICO Upload plugin for WordPress has a significant vulnerability that allows authenticated attackers with a minimum of Author-level permissions to exploit stored Cross-Site Scripting through SVG file uploads. This occurs due to inadequate input sanitization and insufficient output escaping. Consequently, attackers can insert arbitrary web scripts that will execute when a user accesses any SVG file on the affected WordPress site, posing a serious security risk.

Affected Version(s)

Enable SVG, WebP, and ICO Upload 0 <= 1.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/enable-svg-web...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sornram Kampeera
.