snailsploit/cve-2025-12163CVE-2025-12163: Stored Cross-Site Scripting in Omnipress WordPress Plugin
Omnipress WordPress Plugin Stored XSS Vulnerability (CVE-2025-XXXXX) - A stored cross-site scripting vulnerability in the Omnipress Gutenberg blocks plugin allowing authenticated attackers with Author-level privileges to inject malicious scripts.
A stored cross-site scripting (XSS) vulnerability was discovered in the Omnipress WordPress plugin that allows authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
Discovered by: Kai Aizen
Published: December 2025
CVSS Score: 6.4 (Medium)
CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Plugin: Omnipress – WordPress Gutenberg Blocks Plugin
Attack Type: Authenticated (Author+) Stored Cross-Site Scripting
Required Privileges: Author-level access or higher
The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This vulnerability allows authenticated attackers to:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
| Metric | Value |
|---|---|
| Attack Vector | Network (AV:N) |
| Attack Complexity | Low (AC:L) |
| Privileges Required | Low (PR:L) |
| User Interaction | None (UI:N) |
| Scope | Changed (S:C) |
| Confidentiality | Low (C:L) |
| Integrity | Low (I:L) |
| Availability | None (A:N) |
The vulnerability exists due to improper handling of user input in the Omnipress block editor components:
The vulnerability can be exploited by:
A Proof of Concept demonstrating this vulnerability exists but is withheld to allow time for patching and user updates.
Immediate Action Required:
Ensure all user inputs in Gutenberg blocks implement proper security controls:
// Example of proper output escaping in block render
function render_block_content( $attributes ) {
// Escape all user-supplied attributes
$safe_content = esc_html( $attributes['content'] );
$safe_url = esc_url( $attributes['url'] );
$safe_attr = esc_attr( $attributes['customAttr'] );
// Use wp_kses for HTML content with allowed tags
$allowed_html = array(
'a' => array( 'href' => array(), 'title' => array() ),
'strong' => array(),
'em' => array(),
);
$safe_html = wp_kses( $attributes['htmlContent'], $allowed_html );
return sprintf(
'<div class="%s"><a href="https://github.com/snailsploit/cve-2025-12163/blob/main/%25s">%s</a></div>',
$safe_attr,
$safe_url,
$safe_content
);
}
Researchers:
Disclosure Process: Coordinated through Wordfence Bug Bounty Program
This information is provided for security research and defensive purposes only. Any exploitation of this vulnerability for malicious purposes is illegal and unethical. Always obtain proper authorization before testing systems you do not own.
For questions or additional information about this vulnerability:
Last updated: December 2025
This project's full writeup, methodology, and related research lives at:
Created by Kai Aizen — independent offensive security researcher.
snailsploit.com · Research · Frameworks · GitHub · LinkedIn · ResearchGate · X/Twitter
Same attack. Different substrate.