CVE-2025-12457

MediumCVSS 6.4/10Last modified Oct 18, 2026

Description

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ideastocode	Enable SVG, WebP, and ICO Upload	<= 1.1.2

References

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-12467.8Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valha CVE-2025-124605.3An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail messa CVE-2025-124616.9This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker CVE-2025-124629.3A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into UR CVE-2025-124639.8An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi CVE-2025-124646.2A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual netw CVE-2025-124658.6A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user int CVE-2025-124667.5Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authenticatio CVE-2025-124685.3The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive I CVE-2025-124694.3The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Aut CVE-2025-12478.3A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without CVE-2025-124716.1The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the