CVE-2025-12118: Schema Scalpel WordPress Plugin XSS Flaw

CVE-2025-12118 Overview

CVE-2025-12118 is a Stored Cross-Site Scripting (XSS) vulnerability in the Schema Scalpel plugin for WordPress. The flaw affects all versions up to and including 1.6.1. It stems from insufficient input sanitization and output escaping when the plugin writes user-supplied post title data into JSON-LD schema markup. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users load the affected page. The issue is tracked as CWE-79.

Critical Impact
Authenticated contributors can persist malicious scripts in JSON-LD output, enabling session hijacking, redirect chains, or admin account takeover when a privileged user views the injected page.

Affected Products

Schema Scalpel plugin for WordPress, versions <= 1.6.1
WordPress installations that permit Contributor-level or higher user registration
Sites relying on Schema Scalpel to emit JSON-LD structured data

Discovery Timeline

2025-11-01 - CVE-2025-12118 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12118

Vulnerability Analysis

Schema Scalpel generates JSON-LD schema blocks that embed post metadata, including the post title. The plugin fails to sanitize input on the way in and does not escape output when writing values into the JSON-LD payload rendered inside <script type="application/ld+json"> tags. As a result, a contributor can place JavaScript payload syntax or JSON-breaking characters inside a post title. When the page renders, the payload becomes part of the script context and executes in the visitor's browser. The vulnerability requires authentication but no user interaction beyond viewing an affected page.

Root Cause

The root cause is missing sanitization and output escaping in the public-facing schema rendering logic, specifically around the post title handling in class-schema-scalpel-public.php at lines 146 and 183. Because the value is emitted into a <script> element rather than HTML body content, standard HTML escaping alone would be insufficient; the plugin needs context-aware escaping for JSON and script contexts. See the WordPress Plugin Source File for the vulnerable code path.

Attack Vector

An authenticated attacker with Contributor privileges creates or edits a post and stores a crafted title containing script payload. When any visitor, including administrators, loads the post or any page that renders the JSON-LD block, the browser parses the script tag and executes the injected code. This can trigger cookie theft, forced administrative actions via CSRF-like flows, or redirection to attacker-controlled infrastructure. Refer to the Wordfence Vulnerability Report for additional detail.

Detection Methods for CVE-2025-12118

Indicators of Compromise

Post titles containing script fragments, JSON-breaking quotes, or event handler syntax stored in the wp_posts table
Rendered JSON-LD blocks containing unexpected </script> sequences or embedded JavaScript keywords
Outbound requests from browser sessions to unfamiliar domains after viewing content managed by contributors
New administrator accounts or role changes shortly after a Contributor account creates or updates a post

Detection Strategies

Inspect all posts authored by Contributor-level users for titles containing characters such as <, >, ", or \ that could break JSON-LD context
Scan rendered HTML output for <script type="application/ld+json"> blocks that contain unexpected inline JavaScript
Correlate web server access logs with Contributor account activity to identify pages that may serve injected payloads

Monitoring Recommendations

Enable audit logging for WordPress post creation and modification events, filtered by user role
Monitor admin session activity for anomalous administrative actions performed shortly after viewing contributor-authored content
Alert on installations of Schema Scalpel <= 1.6.1 across managed WordPress fleets

How to Mitigate CVE-2025-12118

Immediate Actions Required

Update Schema Scalpel to a version later than 1.6.1 once the vendor publishes a patched release
Audit existing posts for suspicious titles and remove or sanitize any that contain script syntax
Review Contributor and higher accounts, revoke unused access, and reset credentials for suspicious users
Rotate administrator session cookies and enforce reauthentication after remediation

Patch Information

The upstream fix is referenced in the GitHub Commit Reference, which corrects the sanitization and escaping behavior in the schema output. Apply the vendor-supplied plugin update through the WordPress plugin manager or by deploying the patched files.

Workarounds

Temporarily deactivate the Schema Scalpel plugin until a patched version is installed
Restrict Contributor-level registration and manually approve new accounts
Deploy a Web Application Firewall (WAF) rule to block post submissions containing <script> fragments or unbalanced JSON delimiters in the title field

bash

# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate schema-scalpel
wp plugin status schema-scalpel