CVE-2025-12122 Overview
CVE-2025-12122 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Popup Box – Easily Create WordPress Popups plugin for WordPress. The flaw exists in the plugin's iframeBox shortcode across all versions up to and including 3.2.12. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who visits an affected page. The issue is tracked under [CWE-78] in the NVD record, though the behavior aligns with stored XSS patterns.
Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in the context of site visitors and administrators, enabling session theft, content manipulation, and privilege escalation through admin-targeted payloads.
Affected Products
- Popup Box – Easily Create WordPress Popups plugin for WordPress
- All versions up to and including 3.2.12
- WordPress sites permitting contributor-level or higher accounts
Discovery Timeline
- 2026-02-18 - CVE-2025-12122 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-12122
Vulnerability Analysis
The vulnerability resides in the handling of the iframeBox shortcode provided by the Popup Box plugin. The shortcode accepts user-controlled attributes that are rendered into page output without adequate sanitization or escaping. An authenticated user with at least contributor privileges can embed the shortcode in post content with attributes containing JavaScript payloads. When the post is rendered, the malicious payload is emitted into the HTML response and executes in the visitor's browser session.
Because WordPress contributors can author posts pending review, the attack surface includes any site that allows community submissions or has multiple low-privilege editors. The scope change reflected in the CVSS vector indicates that the injected script executes in a security context broader than the attacker's own, including administrative sessions when an admin previews or publishes the post.
Root Cause
The root cause is missing input sanitization on shortcode attributes combined with absent output escaping when the shortcode renders. Trusted WordPress APIs such as sanitize_text_field(), esc_attr(), and esc_url() are not applied to the attribute values before they are embedded into the rendered HTML. This allows raw markup and script-bearing attributes to survive to the browser.
Attack Vector
An authenticated attacker with contributor-level access creates or edits a post containing the iframeBox shortcode with malicious attribute values. The crafted attributes carry JavaScript, typically through event handlers or URL schemes that the browser interprets as executable script. When any user accesses the page, the payload runs with the privileges of that user's session. The attack requires no user interaction beyond visiting the affected page.
No verified proof-of-concept code is published in the NVD record. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Change Log.
Detection Methods for CVE-2025-12122
Indicators of Compromise
- Posts or pages containing the iframeBox shortcode with attributes referencing javascript: URIs, inline event handlers such as onerror, onload, or onmouseover, or <script> fragments.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains shortly after rendering a page that includes the shortcode.
- New or modified posts authored by contributor-level accounts that contain unusual HTML or encoded characters within shortcode attributes.
Detection Strategies
- Query the wp_posts table for post content matching the iframeBox shortcode and inspect attributes for script-bearing values.
- Review WordPress audit logs for contributor or author accounts creating posts with embedded shortcodes that include suspicious attribute content.
- Monitor web server access logs for response bodies that contain reflected attribute values combined with executable JavaScript constructs.
Monitoring Recommendations
- Alert on installations of the Popup Box plugin at versions 3.2.12 or earlier and track upgrade status.
- Track the creation of new low-privilege accounts on WordPress instances exposed to public registration.
- Forward WordPress and web server telemetry to a centralized analytics platform to correlate post edits with anomalous client-side behavior.
How to Mitigate CVE-2025-12122
Immediate Actions Required
- Update the Popup Box – Easily Create WordPress Popups plugin to a version newer than 3.2.12 as soon as a patched release is available.
- Audit existing posts and pages for the iframeBox shortcode and remove or sanitize any instances containing suspicious attribute values.
- Review contributor and author accounts, removing inactive or unrecognized users and enforcing strong authentication for remaining accounts.
Patch Information
The plugin change record is referenced in the WordPress Plugin Change Log. Administrators should consult the Wordfence Vulnerability Report for the fixed version and apply the upgrade through the WordPress plugin manager.
Workarounds
- Disable or uninstall the Popup Box plugin until a patched version is deployed.
- Restrict shortcode usage for contributor-level accounts using a role management plugin or custom kses filter that strips the iframeBox shortcode from low-privilege user submissions.
- Deploy a Web Application Firewall (WAF) rule that inspects post content for the iframeBox shortcode combined with script-indicating attributes and blocks the submission.
# Example wp-cli commands to inventory affected content and the installed plugin version
wp plugin get popup-box --field=version
wp post list --post_type=any --s='[iframeBox' --format=csv --fields=ID,post_title,post_author,post_status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
