CVE-2025-12032
BaseFortify
Publication date: 2025-11-25
Last updated on: 2025-11-25
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wordpress | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress. It occurs due to insufficient input sanitization and output escaping in certain parameters, allowing authenticated administrators to inject malicious scripts that execute when users access the affected pages. It affects all versions up to and including 1.0.0, specifically in multi-site installations or where unfiltered_html is disabled.
How can this vulnerability impact me? :
An attacker with administrator-level access can inject arbitrary scripts into the website, which will execute in the browsers of users who visit the infected pages. This can lead to unauthorized actions, data theft, session hijacking, or defacement of the website. The impact is limited to multi-site installations or those with unfiltered_html disabled.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only trusted administrators have access to the WordPress multi-site installation, especially since the vulnerability requires administrator-level access. Additionally, consider disabling or restricting the use of the affected plugin (Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile) until a patched version beyond 1.0.0 is available. Also, review and adjust the 'unfiltered_html' setting to limit the ability to inject scripts. Monitoring and applying security best practices for input sanitization and output escaping in plugins is recommended.