CVE-2025-12090
BaseFortify
Publication date: 2025-11-01
Last updated on: 2025-11-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | employee_spotlight | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WordPress plugin 'Employee Spotlight – Team Member Showcase & Meet the Team Plugin' up to version 5.1.2. It occurs because social media URLs entered by users are not properly sanitized or escaped before being displayed on employee profile pages. Authenticated users with Contributor-level access or higher can inject malicious JavaScript code into these social URL fields. When other users visit the affected pages, the injected scripts execute in their browsers, potentially compromising their security. [2]
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor-level access or higher to inject malicious scripts into social media URL fields on employee profile pages. When other users view these pages, the malicious scripts execute in their browsers, which can lead to theft of user credentials, session hijacking, defacement, or other malicious actions. This compromises the security and integrity of the website and its users. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Employee Spotlight plugin to version 5.1.3 or later, which includes a fix that properly sanitizes and escapes social media URLs to prevent stored cross-site scripting. This update replaces the insecure esc_html() function with esc_url() for output escaping in social link fields. Additionally, restrict Contributor-level access and above to trusted users to reduce the risk of exploitation. [2]