{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12451", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T20:47:55.593Z", "datePublished": "2026-02-19T03:25:13.845Z", "dateUpdated": "2026-04-08T16:50:22.380Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:22.380Z"}, "affected": [{"vendor": "benjamin_zekavica", "product": "Easy SVG Support", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "title": "Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48ff572a-f18f-4b8d-ac58-78063919ff35?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-svg/trunk/easy-svg.php#L125"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395951%40easy-svg&new=3395951%40easy-svg&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sornram Kampeera"}], "timeline": [{"time": "2026-02-18T15:01:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:04:33.712056Z", "id": "CVE-2025-12451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:42:53.448Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:04:33.712056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:04:35.588Z"}}], "cna": {"title": "Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Sornram Kampeera"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "benjamin_zekavica", "product": "Easy SVG Support", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:01:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48ff572a-f18f-4b8d-ac58-78063919ff35?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-svg/trunk/easy-svg.php#L125"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395951%40easy-svg&new=3395951%40easy-svg&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:22.380Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12451", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:22.380Z", "dateReserved": "2025-10-28T20:47:55.593Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T03:25:13.845Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}, {"lang": "es", "value": "El plugin Easy SVG Support para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de subidas de archivos SVG en todas las versiones hasta la 4.0, inclusive, debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Autor o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda al archivo SVG."}], "id": "CVE-2025-12451", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-02-19T07:17:28.230", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-svg/trunk/easy-svg.php#L125"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395951%40easy-svg&new=3395951%40easy-svg&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48ff572a-f18f-4b8d-ac58-78063919ff35?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Easy SVG Support", "source": "cna", "vendor": "benjamin_zekavica"}, "product": "easy_svg_support", "vendor": "benjaminzekavica"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T15:59:07.404277+00:00", "value": {"mitigation_remediation": ["Upgrade the Easy SVG Support plugin to the latest available version where the input sanitization issue has been fixed.", "If you cannot upgrade immediately, change the upload permissions so that only administrators can upload SVG files or disable SVG uploads entirely via the plugin settings or WordPress mime\u2011type filters.", "As a temporary measure, audit existing SVG files for malicious content, remove any that were uploaded before the fix, and enforce a strict Content\u2011Security\u2011Policy that blocks inline scripts from SVG files."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All releases of the Easy SVG Support plugin for WordPress up to and including version\u202f4.0 are affected. No other products or versions are listed, so WordPress sites that employ this plugin in any of those versions are vulnerable.", "description_and_impact": "The Easy SVG Support plugin stores malicious SVG files uploaded by users with Author-level access, allowing the injection of arbitrary JavaScript that runs whenever a victim views the SVG. This is a classic stored XSS flaw (CWE\u201179) that can lead to cookie theft, session hijacking, or the execution of further malicious payloads inside the victim\u2019s browser.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, and the EPSS score of <\u202f1\u202f% shows a very low likelihood of exploitation. The vulnerability is not currently listed in CISA\u2019s KEV catalog, suggesting no known public exploits. However, since an attacker must be authenticated with Author or higher privileges, the attack vector is limited to internal site editors or administrators using the plugin\u2019s upload interface."}}}}, "created": "2026-02-19T10:07:41.275488+00:00", "updated": "2026-04-21T16:00:13.290169+00:00", "vendors": ["benjaminzekavica", "benjaminzekavica$PRODUCT$easy_svg_support", "wordpress", "wordpress$PRODUCT$wordpress"]}