CVE-2025-12079

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12079", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T15:17:43.050Z", "datePublished": "2025-11-18T09:27:37.488Z", "dateUpdated": "2026-04-08T16:53:37.958Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:37.958Z"}, "affected": [{"vendor": "f1logic", "product": "WP Twitter Auto Publish", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=cve"}, {"url": "https://wordpress.org/plugins/twitter-auto-publish/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412039%40twitter-auto-publish&new=3412039%40twitter-auto-publish&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nicolai Hellesnes"}], "timeline": [{"time": "2025-11-17T20:51:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:11:33.355497Z", "id": "CVE-2025-12079", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:11:44.313Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:11:33.355497Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:11:40.387Z"}}], "cna": {"title": "WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage", "credits": [{"lang": "en", "type": "finder", "value": "Nicolai Hellesnes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "f1logic", "product": "WP Twitter Auto Publish", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T20:51:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=cve"}, {"url": "https://wordpress.org/plugins/twitter-auto-publish/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412039%40twitter-auto-publish&new=3412039%40twitter-auto-publish&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:37.958Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12079", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:53:37.958Z", "dateReserved": "2025-10-22T15:17:43.050Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T09:27:37.488Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Twitter Auto Publish", "vendor": "f1logic", "versions": [{"lessThanOrEqual": "1.7.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin WP Twitter Auto Publish para WordPress es vulnerable a cross-site scripting reflejado v\u00eda PostMessage en todas las versiones hasta la 1.7.3, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-12079", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12079", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T21:11:33.355497Z", "version": "2.0.3"}}]}, "published": "2025-11-18T10:15:46.647", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412039%40twitter-auto-publish&new=3412039%40twitter-auto-publish&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/twitter-auto-publish/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T11:58:12.207909+00:00", "value": {"mitigation_remediation": ["Upgrade WP Twitter Auto Publish to the latest version (1.7.5 or later) where the PostMessage handler sanitizes input.", "If an immediate update is not feasible, disable the auto\u2011publish feature or restrict its usage to trusted users only.", "Deploy a web application firewall or content\u2011security\u2011policy rules to block JavaScript injection attempts against the affected endpoint."], "summary": {"action": "Immediate Patch", "impact": "Reflected Cross\u2011Site Scripting leading to client\u2011side script injection"}, "threat_synthesis": {"affected_systems": "The flaw affects all installations of the WP Twitter Auto Publish WordPress plugin with versions 1.7.4 and earlier. The product is provided by f1logic and user sites should verify that they are using a newer, patched version.", "description_and_impact": "The WP Twitter Auto Publish plugin allows an unauthenticated attacker to inject arbitrary JavaScript through the PostMessage interface because it fails to properly sanitize or escape user\u2011supplied data. An attacker who lures a visitor to a crafted link could have the victim\u2019s browser execute malicious code in the context of the site, potentially accessing site information, stealing credentials, or defacing content. This vulnerability is a classic reflected XSS flaw categorized as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity with impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests that active exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is valid through any guest\u2011visible page that triggers the PostMessage endpoint; an attacker only needs to entice a user to click a crafted link to succeed."}}}}, "created": "2025-11-19T10:47:56.303327+00:00", "updated": "2026-04-22T12:00:05.913907+00:00", "vendors": ["f1logic", "f1logic$PRODUCT$wp_twitter_auto_publish", "wordpress", "wordpress$PRODUCT$wordpress"]}