CVE-2025-12019

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12019", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-21T14:17:08.139Z", "datePublished": "2025-11-11T03:30:52.841Z", "dateUpdated": "2026-04-08T17:34:18.804Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:18.804Z"}, "affected": [{"vendor": "mervinpraison", "product": "Featured Image", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=cve"}, {"url": "https://wordpress.org/plugins/featured-image/"}, {"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md"}, {"url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L35"}, {"url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L65"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392100/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ZAST.AI"}], "timeline": [{"time": "2025-11-10T15:23:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"references": [{"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T14:55:54.801596Z", "id": "CVE-2025-12019", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:04:21.753Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12019", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T14:55:54.801596Z"}}}], "references": [{"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T14:56:08.040Z"}}], "cna": {"title": "Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "ZAST.AI"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mervinpraison", "product": "Featured Image", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:23:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=cve"}, {"url": "https://wordpress.org/plugins/featured-image/"}, {"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md"}, {"url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L35"}, {"url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L65"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392100/"}], "descriptions": [{"lang": "en", "value": "The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:18.804Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12019", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:18.804Z", "dateReserved": "2025-10-21T14:17:08.139Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:52.841Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Featured Image", "vendor": "mervinpraison", "versions": [{"lessThanOrEqual": "2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mer.vin:featured_image:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "59244D41-E48C-4459-AFDB-1EFCABCC9D2D", "versionEndIncluding": "2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Featured Image para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de metadatos de imagen en todas las versiones hasta la 2.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-12019", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12019", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T14:55:54.801596Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:45.797", "references": [{"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md"}, {"source": "security@wordfence.com", "tags": ["URL Repurposed"], "url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L26"}, {"source": "security@wordfence.com", "tags": ["URL Repurposed"], "url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L35"}, {"source": "security@wordfence.com", "tags": ["URL Repurposed"], "url": "https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L65"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3392100/"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/featured-image/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=cve"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:40:42.044674+00:00", "value": {"mitigation_remediation": ["Upgrade the Featured Image plugin to version 2.2 or later, which removes the vulnerable image metadata handling code.", "If an upgrade is not immediately possible, remove image metadata from all existing images and disable the 'unfiltered_html' capability for non\u2011administrator roles to prevent the injection vector.", "Implement a robust Content Security Policy that restricts script execution to trusted sources, thereby mitigating the impact of any XSS payload that may still be present."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via image metadata injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Featured Image plugin up to and including version 2.1. It only applies to multi\u2011site WordPress installations where the unfiltered_html capability has been disabled, and requires an authenticated user with administrator\u2011level permissions or higher. In practice, any site running the vulnerable plugin on version 2.1 or older that permits high\u2011privilege users to upload images is at risk.", "description_and_impact": "The Featured Image plugin for WordPress contains a stored cross\u2011site scripting flaw that allows attackers with administrator privileges to inject arbitrary JavaScript via image metadata. The plugin fails to sanitize and escape this input, so the malicious scripts are rendered and executed whenever a user views a page with the injected image. This can lead to session hijacking, phishing, defacement, or other client\u2011side compromise, affecting confidentiality, integrity, and availability of the site.", "risk_and_exploitability": "With a CVSS score of 4.4 the flaw is categorized as moderate, and the EPSS score is below 1\u202f%, indicating a low likelihood of exploitation at the moment. The flaw is not listed in the CISA KEV catalog, but attackers possessing sufficient administrative rights could leverage the stored XSS to compromise other site users. The attack vector is local to the site's admin account, so the risk is limited to privileged users, but once the attacker injects the payload, any visitor to the affected page can be affected."}}}}, "created": "2025-11-12T12:43:02.264997+00:00", "updated": "2026-04-21T01:45:24.444414+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}