CVE-2025-12019: Mer.vin Featured Image XSS Vulnerability

CVE-2025-12019 Overview

The Featured Image plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to and including 2.1. The flaw resides in how the plugin handles image metadata, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions to inject arbitrary JavaScript. Injected scripts execute whenever a user visits an affected page. The issue only impacts multi-site installations and installations where the unfiltered_html capability has been disabled. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated administrators on WordPress multi-site deployments can store malicious scripts that execute in the context of any user viewing the compromised page, enabling session theft and account takeover.

Affected Products

Mer.vin Featured Image plugin for WordPress — all versions through 2.1
WordPress multi-site installations running the plugin
Single-site installations with unfiltered_html capability disabled

Discovery Timeline

2025-11-11 - CVE-2025-12019 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-12019

Vulnerability Analysis

The Featured Image plugin accepts user-supplied image metadata and renders it back into page output without applying proper sanitization or escaping. An authenticated administrator can supply metadata values containing HTML or JavaScript payloads. When the plugin later emits these values in rendered pages, the browser interprets them as executable script.

The affected code paths are visible in the plugin source at lines 26, 35, and 65 of featured-image.php in the 2.1 release. These locations handle metadata input and output without calling WordPress sanitization helpers such as sanitize_text_field() or escaping functions like esc_html() and esc_attr().

Because the attack requires administrator-level permissions, exploitation is bounded by the trust model of single-site WordPress. The vulnerability becomes meaningful on multi-site networks, where site administrators are not fully trusted by the network owner, and in hardened deployments where unfiltered_html has been removed from administrator roles.

Root Cause

The root cause is missing input sanitization on image metadata fields combined with missing output escaping when that metadata is rendered. The plugin assumes administrator-provided content is safe, which breaks the WordPress multi-site security boundary.

Attack Vector

An attacker with administrator access to a site within a multi-site network authenticates to the WordPress admin interface. The attacker then submits image metadata containing a JavaScript payload through the plugin's input fields. The payload persists in the database. When any user — including super administrators from other sites in the network — views a page where the metadata is rendered, the script executes in their browser session. Technical details are available in the GitHub Vulnerability Report and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-12019

Indicators of Compromise

Image metadata fields in wp_postmeta containing <script>, onerror=, onload=, or javascript: strings
Unexpected outbound requests from browser sessions after loading pages that embed Featured Image content
New or modified administrator accounts following suspicious page views by privileged users
Session cookies appearing in webserver referrer logs to unknown external domains

Detection Strategies

Query the WordPress database for post metadata entries associated with the Featured Image plugin that contain HTML tags or JavaScript event handlers
Review audit logs for metadata update events on sites running the plugin, correlating with administrator sessions
Inspect rendered page HTML for inline scripts in locations where image metadata is expected to appear

Monitoring Recommendations

Enable WordPress activity logging on all multi-site installations with per-site administrator role tracking
Monitor plugin version inventory to identify Featured Image installations still at version 2.1 or earlier
Alert on changes to the unfiltered_html capability configuration across the network
Track browser console errors and Content Security Policy (CSP) violations as a secondary signal of injected scripts

How to Mitigate CVE-2025-12019

Immediate Actions Required

Update the Featured Image plugin to the patched version released after changeset 3392100
Audit all image metadata on multi-site networks for existing injected payloads and remove them
Rotate session cookies and credentials for users who may have viewed compromised pages
Restrict administrator role assignments on multi-site networks to trusted operators only

Patch Information

The vendor addressed the issue in WordPress Plugin Changeset 3392100. The fix adds proper sanitization on metadata input and escaping on output. Download the current release from the WordPress Featured Image Plugin page.

Workarounds

Deactivate the Featured Image plugin until the patched version has been deployed
Restore the unfiltered_html capability only for fully trusted super administrators on multi-site networks
Deploy a web application firewall rule to block requests containing script tags in plugin metadata parameters
Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin

bash

# Example WP-CLI command to identify sites running vulnerable versions
wp plugin list --name=featured-image --fields=name,status,version --allow-root

# Deactivate across all sites on a multi-site network
wp plugin deactivate featured-image --network --allow-root