CVE-2025-12021: WP-OAuth Plugin XSS Vulnerability

CVE-2025-12021 Overview

CVE-2025-12021 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WP-OAuth plugin for WordPress in all versions up to and including 0.4.1. The flaw resides in the handling of the error_description parameter, which is reflected into rendered pages without adequate input sanitization or output escaping. Unauthenticated attackers can craft malicious URLs that inject arbitrary JavaScript, executing in a victim's browser session when the link is visited. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in a victim's browser, enabling session theft, credential harvesting, or redirection to malicious content when a WordPress user clicks a crafted link.

Affected Products

WP-OAuth plugin for WordPress, versions up to and including 0.4.1
WordPress sites integrating WP-OAuth for Google login flows (login-google.php)
WordPress installations using WP-OAuth error handling paths in wp-oauth.php

Discovery Timeline

2025-11-11 - CVE-2025-12021 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12021

Vulnerability Analysis

The vulnerability stems from the WP-OAuth plugin reflecting the error_description query parameter back into HTML responses without proper sanitization or contextual output escaping. When an OAuth flow encounters an error, the plugin embeds attacker-controlled data directly into the response page. This behavior allows arbitrary HTML and JavaScript payloads supplied via the URL to render as executable content in the victim's browser.

The issue is a client-side injection that requires user interaction to exploit. An attacker distributes a crafted link via phishing, social media, or embedded content. When the target clicks the link, the injected script executes in the context of the vulnerable WordPress site's origin, inheriting the victim's session privileges. Because exploitation crosses trust boundaries into the browser's Document Object Model (DOM), the impact scope changes, affecting resources beyond the vulnerable component itself.

Root Cause

The root cause is missing input validation and output encoding for the error_description parameter across multiple code paths in the plugin. Referenced source lines include login-google.php line 42 and wp-oauth.php at lines 430 and 545, where user-supplied error content is echoed into HTML without escaping functions such as esc_html() or esc_attr(). See the WordPress Plugin Code Review for login-google.php and wp-oauth.php line 430 for the affected code.

Attack Vector

Exploitation is network-based and unauthenticated. An attacker crafts a URL to the vulnerable WordPress endpoint containing a malicious payload in the error_description parameter. When a logged-in administrator or user clicks the link, the injected script executes with the privileges of that session. Payloads can exfiltrate cookies, perform actions on the user's behalf via the WordPress REST API, or pivot to persistent compromise through account manipulation.

No verified proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-12021

Indicators of Compromise

HTTP requests to WP-OAuth endpoints containing error_description parameter values with HTML tags, <script> elements, or JavaScript event handlers such as onerror= and onload=.
Web server access logs showing URL-encoded payloads (e.g., %3Cscript%3E, %22onmouseover%3D) targeting login-google.php or other WP-OAuth routes.
Anomalous outbound requests from browsers to attacker-controlled domains shortly after users interact with WordPress login pages.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for reflected XSS signatures targeting the error_description parameter across WP-OAuth request paths.
Correlate referrer headers and click-through patterns from external sources leading to WP-OAuth endpoints with unusual query strings.
Monitor browser console error telemetry and Content Security Policy (CSP) violation reports originating from WordPress domains hosting WP-OAuth.

Monitoring Recommendations

Enable verbose logging on WordPress and the fronting web server to capture full request URIs including query parameters for post-incident analysis.
Deploy CSP headers with report-uri or report-to directives to detect inline script execution attempts.
Alert on administrator account changes, plugin installations, or user role modifications occurring shortly after clicks on external referrers.

How to Mitigate CVE-2025-12021

Immediate Actions Required

Deactivate the WP-OAuth plugin on all WordPress instances running version 0.4.1 or earlier until a patched release is confirmed and installed.
Audit administrator and editor accounts for unauthorized changes, newly created users, or unexpected API tokens.
Apply WAF rules to block requests containing script tags or JavaScript event handlers in the error_description parameter.

Patch Information

No patched version has been identified in the NVD entry at the time of publication. Administrators should monitor the WordPress plugin repository and the Wordfence Vulnerability Analysis for release information and apply updates as soon as they are published.

Workarounds

Disable the WP-OAuth plugin entirely if OAuth login functionality is not business-critical.
Configure a WAF rule to reject any request to WordPress URLs containing suspicious characters (<, >, ", ', javascript:) in the error_description query parameter.
Enforce a strict Content Security Policy that blocks inline script execution and restricts script sources to trusted origins.
Educate administrators and privileged users to avoid clicking OAuth-related links from untrusted sources.

bash

# Example ModSecurity rule to block reflected XSS payloads in error_description
SecRule ARGS:error_description "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1012021,phase:2,deny,status:403,\
    msg:'CVE-2025-12021 WP-OAuth Reflected XSS attempt blocked',\
    tag:'CWE-79',tag:'wordpress',tag:'wp-oauth'"