PT-2025-47702 · WordPress · Wordpress+1

Moose Love · Published 2025-11-21 · Updated 2025-11-26 · CVE-2025-13159

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress versions up to and including 1.0.43

Description The Flo Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. The plugin permits SVG file uploads via an unauthenticated AJAX endpoint, flo form submit, without sufficient file content validation. This allows unauthenticated attackers to upload malicious SVG files containing JavaScript. When an administrator views the uploaded file within the WordPress admin interface, the malicious JavaScript executes, potentially leading to a full site compromise.

Recommendations Update Flo Forms – Easy Drag & Drop Form Builder plugin to a version later than 1.0.43.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13159

Affected Products

Flo Forms

Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13159 · Security Note
• https://twitter.com/cracbot/status/1993635897137627329 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991798760888782933 · Twitter Post
• https://t.me/CVEtracker/37914 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8c529017-2fb9-4665-97a6-3ec062908299?source=cve · Note
• https://plugins.trac.wordpress.org/browser/flo-forms/trunk/admin/class-flo-forms-admin.php#L821 · Note
• https://twitter.com/CVEnew/status/1991776209504727490 · Twitter Post
• https://plugins.trac.wordpress.org/browser/flo-forms/trunk/public/class-flo-forms-public.php#L502 · Note
• https://plugins.trac.wordpress.org/browser/flo-forms/trunk/includes/class-flo-forms.php#L301 · Note