Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Flo-Forms-CVE-Report — Disclosure for CVE-2025-13159 | Kitploit
Tools/GitHubGitHub/mooseloveti/flo-forms-cve-report
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubmooseloveti/flo-forms-cve-report

Flo-Forms-CVE-Report

Disclosure for CVE-2025-13159

View Repository
8 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Flo-Forms-CVE-Report

Disclosure for CVE-2025-13159

CVE-2025-13159 - Vulnerability in Flo Forms – Easy Drag & Drop Form Builder

This repository discloses a vulnerability discovered in Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43,WordPress plugin developed by flothemesplugins.

🛠 Affected Version

  • Product: Flo Forms – Easy Drag & Drop Form Builder
  • Version: v1.0.43
  • URL: https://wordpress.org/plugins/flo-forms/

🔒 Assigned CVE

Download Tool
CVE IDTypeComponentImpact
CVE-2025-13159Unauthenticated Stored Cross-Site Scripting via SVG Uploadpublic/class-flo-forms-public.phpUnauthenticated attacker can execute JS

🧾 Detailed a Description

CVE-2025-13159 — Unauthenticated Stored Cross-Site Scripting via SVG Upload

  • Affected Component: Flo Forms admin page
  • Attack Vector: Unauthenticated Stored Cross-Site Scripting via SVG Upload
  • Trigger: An attacker can inject malicious scripts into the admin interface by exploiting the flo_form_submit to store arbitrary scripts via SVG Upload.
root@kitploit:~
curl -k -X POST "https://localhost:8080/wp-admin/admin-ajax.php" \
  -F 'action=flo_form_submit' \
  -F 'flo_fid=<your fid>' \
  -F 'flo-form-model={}' \
  -F 'flo-form-schema={"groups":[]}' \
  -F '[email protected];type=image/svg+xml'

※If the fid within the object does not exist, it will fail.

  • Impact: Stored scripts may be executed, posing a risk of serious harm such as account hijacking.

❓Reason for the vulnerability

The plugin expands WordPress’s allowed MIME types to include image/svg+xml and exposes an unauthenticated AJAX action (flo_form_submit) that accepts file attachments and passes them to media_handle_upload() without any SVG sanitization or capability checks. Uploaded SVGs are then served back as image/svg+xml and linked from the admin UI. When an administrator opens the attachment (directly, or via /), the browser interprets the SVG document and executes embedded scripts, resulting in stored XSS.

  • Exclude SVG from the allowed MIME types.

ひとこと

一ヵ月経過したが、まだパッチは公開されておらず、ダウンロード自体停止されている。 今回はPoCの再現がなかなか上手くいかず、1時間以上詰まったが結果的にXSS.svgの前にアットマーク(@)を付け忘れていたことが判明。

🔍 Discoverer

Name: MooseLove
Role: Independent security researcher / bug hunter
Contact: Available upon request

📚 References

  • Product: https://wordpress.org/plugins/flo-forms/

⚠️ License

This advisory is provided for public security awareness. Free to share with attribution.