CVE-2025-13159: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in flothemesplugins Flo Forms – Easy Drag & Drop Form Builder
The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX endpoint (`flo_form_submit`) without proper file content validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when an administrator views the uploaded file in the WordPress admin interface, leading to potential full site compromise.
AI Analysis
Technical Summary
CVE-2025-13159 is a stored cross-site scripting vulnerability in the Flo Forms – Easy Drag & Drop Form Builder WordPress plugin (up to version 1.0.43). The plugin allows unauthenticated attackers to upload SVG files via the `flo_form_submit` AJAX endpoint without proper validation of file content. Malicious JavaScript embedded in these SVG files executes in the context of the WordPress admin interface when viewed by an administrator, potentially leading to full site compromise. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the WordPress admin interface, which can lead to full site compromise including data theft, administrative control takeover, and disruption of site availability. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable AJAX endpoint if possible, disable SVG uploads, or implement additional server-side validation to block malicious SVG content. Monitor for updates from the vendor and apply patches promptly once available.
CVE-2025-13159: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in flothemesplugins Flo Forms – Easy Drag & Drop Form Builder
Description
The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX endpoint (`flo_form_submit`) without proper file content validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when an administrator views the uploaded file in the WordPress admin interface, leading to potential full site compromise.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-13159 is a stored cross-site scripting vulnerability in the Flo Forms – Easy Drag & Drop Form Builder WordPress plugin (up to version 1.0.43). The plugin allows unauthenticated attackers to upload SVG files via the `flo_form_submit` AJAX endpoint without proper validation of file content. Malicious JavaScript embedded in these SVG files executes in the context of the WordPress admin interface when viewed by an administrator, potentially leading to full site compromise. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the WordPress admin interface, which can lead to full site compromise including data theft, administrative control takeover, and disruption of site availability. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable AJAX endpoint if possible, disable SVG uploads, or implement additional server-side validation to block malicious SVG content. Monitor for updates from the vendor and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-11-14T00:33:54.064Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6920235bcf2d47c38997b556
Added to database: 11/21/2025, 8:31:23 AM
Last enriched: 4/9/2026, 4:27:08 PM
Last updated: 5/10/2026, 3:48:04 AM
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.