CVE-2025-12065 Overview
CVE-2025-12065 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Carticon plugin for WordPress. The flaw resides in the carticon_js_script parameter and affects all versions up to and including 1.0.0. Insufficient input sanitization and output escaping allow authenticated administrators to inject arbitrary JavaScript that executes when users load an affected page. The issue is scoped to WordPress multi-site installations and single-site deployments where the unfiltered_html capability has been disabled. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated administrators on WordPress multi-site installations can inject stored JavaScript through the WP Carticon plugin, enabling browser-based attacks against site visitors and other administrators.
Affected Products
- WordPress WP Carticon plugin versions <= 1.0.0
- WordPress multi-site installations running WP Carticon
- WordPress single-site installations with unfiltered_html disabled
Discovery Timeline
- 2025-11-04 - CVE-2025-12065 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12065
Vulnerability Analysis
The WP Carticon plugin exposes a carticon_js_script parameter that accepts script content for the cart icon feature. The plugin fails to sanitize input on write and does not escape output on render. As a result, JavaScript stored through this parameter is served to visitors verbatim.
WordPress ordinarily allows administrators to submit raw HTML and JavaScript through the unfiltered_html capability. On multi-site installations, only Super Admins hold this capability by default, so regular site administrators are treated as untrusted for HTML content. This vulnerability breaks that trust boundary by allowing any authenticated administrator to store executable scripts through the plugin.
Because the injected payload is stored server-side, it fires on every visit to the affected page. Attackers can hijack authenticated sessions, perform actions in the context of Super Admins, redirect visitors, or stage further attacks against the site.
Root Cause
The plugin trusts input to the carticon_js_script field without applying WordPress sanitization functions such as wp_kses() or sanitize_text_field(). On output, the value is written into page markup without esc_html() or esc_attr() calls. This bypasses the multi-site content restrictions that normally gate JavaScript authoring behind the Super Admin role.
Attack Vector
An authenticated attacker with site administrator privileges submits a payload containing JavaScript through the plugin's settings interface. The plugin persists the payload to the database and later injects it into pages served to any visitor. Exploitation requires an existing administrator account and a vulnerable multi-site configuration, which raises the attack complexity. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-12065
Indicators of Compromise
- Unexpected <script> tags or event handlers appearing in pages that render the WP Carticon widget
- Modifications to plugin option rows storing the carticon_js_script value in the wp_options table
- Outbound requests from visitor browsers to attacker-controlled domains following a page load
Detection Strategies
- Audit the WP Carticon plugin settings and inspect the carticon_js_script field for any script content that is not part of a documented configuration
- Review WordPress audit logs for administrator edits to plugin settings on multi-site subsites
- Scan rendered page output for JavaScript patterns that do not originate from expected theme or plugin sources
Monitoring Recommendations
- Enable a WordPress activity log plugin to record administrator changes to plugin options
- Monitor Content Security Policy (CSP) violation reports for inline script executions on pages hosting the cart icon
- Alert on new administrator account creation and privilege changes across all subsites in multi-site deployments
How to Mitigate CVE-2025-12065
Immediate Actions Required
- Deactivate the WP Carticon plugin on all affected multi-site installations until a patched release is available
- Review the carticon_js_script setting on every subsite and remove any unexpected JavaScript payloads
- Rotate credentials for administrator accounts that may have been compromised or misused
Patch Information
No fixed version is listed in the enriched data at the time of publication. Consult the WordPress Plugin page for WP Carticon and the Wordfence Vulnerability Report for the latest patch status and apply updates as soon as a fixed version is released.
Workarounds
- Restrict administrator role assignments on multi-site networks and limit trusted administrators to the Super Admin role only
- Deploy a web application firewall rule to block script content submitted to the carticon_js_script parameter
- Implement a strict Content Security Policy that disallows inline scripts on public pages
# Configuration example: disable the plugin via WP-CLI across a multi-site network
wp plugin deactivate wp-carticon --network
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.