CVE-2025-12163Medium· 6.4▾ TwilightPoC available

The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score47/ 100 · Moderate

impact 35.2 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Dec 5, 2025

Updated

Sep 25, 2026

CVSS

6.4

Vendor

—

Product

—

CWE

CWE-79

Depth score

47 · Moderate

EPSS

0.36% · p27

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-25

GitHub PoCs

1 public repository

SnailSploit/CVE-2025-12163 ↗

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 295 days

Dec 5, 2025Published
Disclosed via NVD
Sep 25, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS first tracked
0.4%
Sep 25, 2026Public exploit observed
1 GitHub repo (last check)

CWE-79 #nvd #exploit-available

Full technical detail▾

Overview

The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available

← Back to feed