PT-2026-1410 · WordPress · Url Image Importer

Sirati Hiranthani · Publicado 2026-01-06 · Atualizado 2026-01-06 · CVE-2025-14120

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions URL Image Importer plugin for WordPress versions up to and including 1.0.7

Description The URL Image Importer plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient sanitization of SVG files allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts. These scripts will execute when a user accesses the SVG file.

Recommendations Update the URL Image Importer plugin to a version newer than 1.0.7.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-14120

Produtos afetados

Url Image Importer

Referências · 9

• https://t.me/CVEtracker/41475 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L176 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/8704320e-9624-4924-92e8-adb61356aecb?source=cve · Nota
• https://t.me/cveNotify/147797 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2008486869814661561 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14120 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3429292%40url-image-importer&new=3429292%40url-image-importer&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/url-image-importer/tags/1.0.7/url-image-importer.php#L176 · Nota
• https://twitter.com/CVEnew/status/2008408714445791321 · Publicação no Twitter