CVE-2025-12371: Nari Accountant WordPress Plugin XSS Vulnerability

CVE-2025-12371 Overview

CVE-2025-12371 is a Stored Cross-Site Scripting (XSS) vulnerability in the Nari Accountant plugin for WordPress. The flaw affects all versions up to and including 1.0.12 and stems from insufficient input sanitization and output escaping in account settings. Authenticated attackers with editor-level permissions or higher can inject arbitrary JavaScript that executes when other users visit an affected page. The vulnerability is classified as [CWE-79] and only impacts multi-site installations or installations where unfiltered_html has been disabled.

Critical Impact
Editor-level attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action forgery, and account takeover of higher-privileged users on multi-site instances.

Affected Products

Nari Accountant plugin for WordPress (all versions up to and including 1.0.12)
WordPress multi-site installations running the plugin
WordPress installations with unfiltered_html disabled

Discovery Timeline

2025-11-04 - CVE-2025-12371 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12371

Vulnerability Analysis

The Nari Accountant plugin fails to properly sanitize input and escape output within its account settings functionality. This allows authenticated users to store malicious JavaScript payloads that persist in the database. When any user renders a page containing the injected payload, the script executes in the victim's browser under the site's origin.

Stored XSS in a WordPress plugin creates a foothold for cross-user attacks. An editor can escalate privileges by targeting administrators, forge authenticated requests, or exfiltrate cookies and nonces. The requirement for editor-level access reduces the attack surface but does not eliminate risk, particularly in multi-author environments where editors are numerous.

Root Cause

The plugin accepts user-supplied values through account settings without applying WordPress sanitization functions such as sanitize_text_field() or wp_kses(). Output is rendered directly without escaping via esc_html(), esc_attr(), or esc_js(). The absence of both defenses produces the classic stored XSS pattern described by [CWE-79].

Attack Vector

Exploitation requires an authenticated session with editor-level privileges. On standard single-site WordPress installations where editors retain the unfiltered_html capability, the injection is expected behavior. The vulnerability manifests only when unfiltered_html is stripped, which occurs by default on multi-site networks and hardened deployments. An attacker submits crafted input through the plugin's account settings interface, and the payload triggers when victims load an affected page. See the Wordfence Vulnerability Report for additional technical context.

No verified public proof-of-concept code is available. The vulnerability class involves storing unsanitized markup and rendering it back to page viewers without escaping.

Detection Methods for CVE-2025-12371

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) stored in Nari Accountant plugin database tables or WordPress post/page content
Outbound requests from visitor browsers to unfamiliar domains after loading pages managed by the plugin
Editor accounts modifying account settings outside of normal business patterns
New administrator accounts created shortly after editor-level activity involving the plugin

Detection Strategies

Audit WordPress database entries associated with the Nari Accountant plugin for HTML tags and JavaScript event handlers
Deploy a web application firewall with signatures for stored XSS payloads targeting WordPress plugin endpoints
Enable WordPress security logging to record edits by editor-level accounts and correlate against expected workflows
Review Content Security Policy (CSP) violation reports for inline script execution originating from plugin-rendered pages

Monitoring Recommendations

Monitor wp_usermeta and plugin-specific tables for anomalous HTML or script content
Track authentication events for editor accounts, focusing on unusual IP addresses or session times
Alert on privilege changes and administrator account creation events
Log and review all requests to plugin administrative endpoints

How to Mitigate CVE-2025-12371

Immediate Actions Required

Update the Nari Accountant plugin to a version newer than 1.0.12 once the vendor publishes a patched release
Audit all editor-level accounts and remove privileges from users who do not require them
Review existing plugin content for injected scripts and remove any malicious payloads
Rotate credentials and session tokens for administrators who may have accessed injected pages

Patch Information

Refer to the Nari Accountant plugin page on WordPress.org for updates and patched versions. Verify the changelog confirms remediation of CVE-2025-12371 before deployment. Monitor the Wordfence Vulnerability Report for patch status updates.

Workarounds

Deactivate and remove the Nari Accountant plugin until a patched version is available
Restrict editor-level access to trusted personnel only on multi-site installations
Implement a strict Content Security Policy that blocks inline scripts and untrusted origins
Deploy a WordPress-aware web application firewall to filter XSS payloads at plugin endpoints

bash

# Example: enforce a restrictive Content Security Policy header in nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;