EUVD-2025-211018
GHSA-25mm-vqww-gc8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Author-level WordPress account
-
DeliveryUpload malicious SVG via plugin uploader
-
ExploitStored payload bypasses sanitization
-
ExecutionVictim opens SVG file URL
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with Author-level capabilities or higher (PR:L), and the target site must have the Viable URL Media Uploader plugin (version ≤1.0.0) installed and permit SVG uploads through it. The stored payload only fires when a user subsequently navigates to the uploaded SVG file's URL, so realized impact depends on a victim accessing that file. Limiting factors: the required privileged (Author+) role narrows the attacker pool to trusted/registered users or accounts obtained through separate compromise, and the plugin's niche deployment further constrains real-world exposure; no anonymous or unauthenticated path exists. |
| Impact | This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world risk is bounded well below its numeric score. The network vector and low complexity are offset by PR:L, which per the description means Author-level access or above is required - a meaningfully privileged, semi-trusted role rather than an anonymous attacker. The scope change (S:C) and only-partial C/I impact reflect script execution in the victim's browser context when the SVG is accessed, not server compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. There is no conflict between the CVSS vector and the description - both agree on authenticated, network-delivered stored XSS. Net: a legitimate issue to patch but not an urgent, mass-exploitation priority, and its impact is gated by both the required privilege level and the plugin's small footprint. |
| Exploit ScenarioDerived | An attacker holding (or having compromised) a WordPress Author-or-above account uploads a crafted SVG file containing embedded JavaScript through the Viable URL Media Uploader plugin, which fails to sanitize the file content. When an administrator or other user later opens the SVG's URL, the embedded script executes in their browser session in the site's origin. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Stored cross-site scripting in the WordPress plugin Viable URL Media Uploader (all versions up to and including 1.0.0) lets an authenticated user holding Author-level capabilities or higher upload a crafted SVG file whose embedded script content is neither sanitized on upload nor escaped on output, so the payload executes whenever a visitor or administrator browses directly to the uploaded SVG's URL. The flaw carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a scope change into the browsing context plus low confidentiality and integrity impact; exploitation is gated by the Author+ prerequisite, so the attacker pool is limited to trusted or already-compromised accounts on sites running this niche plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the Wordfence disclosure and a linked Trac source reference make the vulnerable code path publicly visible.
RemediationAI
No vendor-released patch was identified at time of analysis: the only code reference supplied points at the unfixed vulnerable handler (class-vumu-svg-support.php line 42), and no patched plugin version is named in the advisory data, so administrators should treat version 1.0.0 and below as unfixed. The primary action is to deactivate and remove the Viable URL Media Uploader plugin from any site that does not strictly require it, accepting the loss of its URL-based media import feature. If the plugin must stay, disable SVG uploads entirely by adding the file type to WordPress's disallowed upload list (unfiltered_upload / upload_mimes restrictions) or by enforcing SVG sanitization through a maintained security plugin - noting that over-broad MIME whitelisting can re-open this path. Immediately scan the media library for existing .svg attachments, treat any containing <script> or event-handler attributes as malicious, and delete or quarantine them, since the stored payload remains live until the file is removed. Restrict Author and Contributor roles to personnel who genuinely need publishing rights, or downgrade them, because PR:L means any Author+ account can plant the payload; audit accounts for signs of separate compromise. Deploy a Content-Security-Policy that blocks inline script and constrains script-src to trusted origins to blunt execution of any previously uploaded file, understanding that CSP is a compensating control and does not remediate the underlying defect. Monitor for direct requests to uploaded SVG paths in web-server logs as a detection signal, and consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/c600d267-0fed-4682-bc71-5bd0d2f70cae?source=cve) for any subsequently published fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-79 improper-neutralization-of-input-during-web-page-generation defect occurring in the SVG handling path of the plugin's class-vumu-svg-support.php file (referenced at line 42 of the trunk source on WordPress Trac). SVG is an XML-based image format that can legitimately contain <script> elements, event handler attributes such as onload, and external entity or javascript: URI constructs; WordPress's default upload pipeline blocks SVG for exactly this reason, and plugins that re-enable it must re-implement strict sanitization. Here the plugin permits SVG uploads via its URL media uploader but fails to strip active content on ingest and does not escape the stored file content when it is later served, so a malicious SVG becomes a persistent script-delivery vehicle hosted on the victim site's own origin. The CPE entry cpe:2.3:a:ahsangadit:viable_url_media_uploader:*:*:*:*:*:*:*:* confirms that all released versions of the plugin from the vendor ahsangadit are in scope, matching the EUVD "Viable URL Media Uploader 0 \u22641.0.0" range. Because the response is served from the target domain and the CVSS vector marks S:C (scope change), the injected script can act with the origin's trust, reaching cookies, CSRF tokens, and authenticated AJAX endpoints of any user who opens the file.
Know when Viable Url Media Uploader gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Requires an authenticated Author-level account (PR:L) over the network; stored SVG script executes in another user's browser context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB