CVE-2025-2513

Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published Apr 2, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Analysis

Technical impact

The Smart Icons For WordPress plugin permits users to upload SVG files, but the code fails to sanitize and escape user input. Consequently, an attacker with Editor-level or higher privileges can embed malicious script tags inside an SVG upload, causing those scripts to run whenever any site visitor loads the file. This stored cross‑site scripting flaw is a classic CWE‑79 problem that can lead to session hijacking, defacement, or credential theft.

Affected Systems

All WordPress installations that have the Smart Icons For WordPress plugin (smartpixels:Smart Icons For WordPress) at version 1.0.4 or earlier are affected. Any site running this plugin and allowing SVG uploads is vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. Its EPSS score is below 1%, suggesting that exploitation attempts are currently rare, and it is not listed in the CISA KEV catalog. However, because the flaw requires authenticated access with at least Editor rights, the attack vector is internal, so attackers must already have legitimate site access to exploit it.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

smartpixels

Smart Icons For WordPress

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.4

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Smart Icons For WordPress to the latest available version, or remove the plugin if it is no longer supported.
If an update is not available, disable the SVG upload feature or restrict it to administrators only.
Implement a web application firewall or file‑upload sanitizer that strips disallowed tags from SVG content to prevent script injection.

Generated by OpenCVE AI on April 21, 2026 at 21:30 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-9550	The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.331% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/smartifw/tags/1.0.4/includes/media.php#L3
https://plugins.trac.wordpress.org/browser/smartifw/tags/1.0.4/smart_icons_for_wordpress.php#L86
https://wordpress.org/plugins/smartifw/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5d8eac-fca9-4222-9a5f-a12748d298ec?source=cve

History

Apr 2, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 2, 2025 9:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Title		Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/smartifw/tags/1.0.4/includes/media.php#L3 https://plugins.trac.wordpress.org/browser/smartifw/tags/1.0.4/smart_icons_for_wordpress.php#L86 https://wordpress.org/plugins/smartifw/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5d8eac-fca9-4222-9a5f-a12748d298ec?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`