BaseFortify

Publication date: 2025-11-01

Last updated on: 2025-11-04

Assigner: Wordfence

Description

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-01

Last Modified

2025-11-04

Generated

2026-07-06

AI Q&A

2025-11-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12090

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	employee_spotlight	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WordPress plugin 'Employee Spotlight – Team Member Showcase & Meet the Team Plugin' up to version 5.1.2. It occurs because social media URLs entered by users are not properly sanitized or escaped before being displayed on employee profile pages. Authenticated users with Contributor-level access or higher can inject malicious JavaScript code into these social URL fields. When other users visit the affected pages, the injected scripts execute in their browsers, potentially compromising their security. [2]

Impact Analysis

This vulnerability can allow attackers with Contributor-level access or higher to inject malicious scripts into social media URL fields on employee profile pages. When other users view these pages, the malicious scripts execute in their browsers, which can lead to theft of user credentials, session hijacking, defacement, or other malicious actions. This compromises the security and integrity of the website and its users. [2]

Mitigation Strategies

To mitigate this vulnerability, immediately update the Employee Spotlight plugin to version 5.1.3 or later, which includes a fix that properly sanitizes and escapes social media URLs to prevent stored cross-site scripting. This update replaces the insecure esc_html() function with esc_url() for output escaping in social link fields. Additionally, restrict Contributor-level access and above to trusted users to reduce the risk of exploitation. [2]

Hi! I’m here to help you understand CVE-2025-12090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70