CVE-2025-12520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12520", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T16:30:34.365Z", "datePublished": "2025-11-07T05:29:57.900Z", "dateUpdated": "2026-04-08T16:56:37.713Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:37.713Z"}, "affected": [{"vendor": "jgwhite33", "product": "WP Airbnb Review Slider", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6082f25f-b060-431b-a18c-65899851bf3b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-airbnb-review-slider/tags/4.2&new_path=/wp-airbnb-review-slider/tags/4.3&sfp_email=&sfph_mail="}, {"url": "https://cyberresearchhub.com/cve-2025-12520/"}, {"url": "https://cyberresearchhub.com/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "CyberResearchHub.com"}], "timeline": [{"time": "2025-11-06T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-07T13:24:03.226122Z", "id": "CVE-2025-12520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T13:25:00.440Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-07T13:24:03.226122Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T13:24:11.812Z"}}], "cna": {"title": "WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "CyberResearchHub.com"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jgwhite33", "product": "WP Airbnb Review Slider", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-06T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6082f25f-b060-431b-a18c-65899851bf3b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-airbnb-review-slider/tags/4.2&new_path=/wp-airbnb-review-slider/tags/4.3&sfp_email=&sfph_mail="}, {"url": "https://cyberresearchhub.com/cve-2025-12520/"}, {"url": "https://cyberresearchhub.com/"}], "descriptions": [{"lang": "en", "value": "The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:37.713Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12520", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:37.713Z", "dateReserved": "2025-10-30T16:30:34.365Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-07T05:29:57.900Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Airbnb Review Slider", "vendor": "jgwhite33", "versions": [{"lessThanOrEqual": "4.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin WP Airbnb Review Slider para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 4.2, inclusive, debido a una validaci\u00f3n de URL insuficiente que permite a los usuarios cargar un archivo HTML malicioso. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio e instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-12520", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-07T13:24:03.226122Z", "version": "2.0.3"}}]}, "published": "2025-11-07T06:15:33.013", "references": [{"source": "security@wordfence.com", "url": "https://cyberresearchhub.com/"}, {"source": "security@wordfence.com", "url": "https://cyberresearchhub.com/cve-2025-12520/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-airbnb-review-slider/tags/4.2&new_path=/wp-airbnb-review-slider/tags/4.3&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6082f25f-b060-431b-a18c-65899851bf3b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:37:37.160323+00:00", "value": {"mitigation_remediation": ["Upgrade WP Airbnb Review Slider to version\u202f4.3 or newer, which removes the vulnerable URL validation path.", "If an upgrade cannot be performed immediately, replace the plugin\u2019s external\u2011URL feature by removing or disabling the option for administrators until remediation is possible.", "Apply a web\u2011application firewall rule that blocks execution of injected JavaScript or sanitizes stored URLs in the plugin\u2019s database entries."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin WP Airbnb Review Slider developed by jgwhite33. All plugin versions 4.2 and earlier are vulnerable. The vulnerability only manifests on multisite installations where the WordPress option unfiltered_html has been disabled, meaning that sites using the default filtering rules are at risk.", "description_and_impact": "The WP Airbnb Review Slider plugin for WordPress is vulnerable to stored Cross\u2011Site Scripting in all releases up to version\u202f4.2. The flaw arises from insufficient validation of URLs entered into the plugin\u2019s administration settings, allowing an administrator or higher to upload a malicious HTML file that is then stored and served to site visitors. When a user views a page containing the injected content, the embedded script executes in that user\u2019s browser, which can lead to session hijacking, cookie theft, defacement, or other client\u2011side attacks. This weakness is identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 4 indicates a moderate severity, while the EPSS score of less than 1\u202f% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with administrator\u2011level permissions, and the injection is performed through the plugin\u2019s own settings interface. Once the malicious script is stored, it is executed automatically on any page that includes the injected URL. Although the likelihood of widespread exploitation is low at present, the impact of a successful XSS can be significant, especially on sites that rely on the plugin for interactive displays."}}}}, "created": "2025-11-07T10:53:40.426094+00:00", "updated": "2026-04-22T00:45:04.157304+00:00", "vendors": ["jgwhite33", "jgwhite33$PRODUCT$wp_thumbtack_review_slider", "wordpress", "wordpress$PRODUCT$wordpress"]}