CVE-2025-12393 Overview
The Free Quotation plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings. The flaw affects all versions up to and including 3.1.6. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. The injected scripts execute when any user accesses an affected page. The issue only impacts WordPress multi-site installations and installations where the unfiltered_html capability has been disabled. The vulnerability is tracked as CWE-79.
Critical Impact
Authenticated administrators on multi-site WordPress installations can inject persistent JavaScript that executes in the browsers of other site visitors and administrators.
Affected Products
- WordPress Free Quotation plugin versions up to and including 3.1.6
- WordPress multi-site installations running the plugin
- WordPress installations where the unfiltered_html capability has been disabled
Discovery Timeline
- 2025-11-04 - CVE-2025-12393 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12393
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw in the admin settings interface of the Free Quotation plugin. The plugin accepts input through its administrative settings pages but fails to sanitize the values on input and does not escape them on output. As a result, script payloads submitted through the settings are stored in the WordPress database and rendered verbatim when pages that include those settings are viewed.
Exploitation requires an authenticated account with administrator-level privileges. On standard single-site WordPress installations, administrators already hold the unfiltered_html capability and can legitimately post HTML and scripts, which is why the flaw is only exploitable in multi-site setups or when unfiltered_html has been explicitly revoked. In those environments, administrators are constrained from posting raw HTML, and the plugin's failure to enforce equivalent sanitization creates a bypass.
Root Cause
The root cause is a missing input sanitization and output escaping pair in the plugin's admin settings handlers. WordPress provides functions such as sanitize_text_field(), wp_kses(), and esc_attr() / esc_html() for these purposes. The plugin does not apply these to settings values, so attacker-controlled markup persists in the database and is echoed into rendered pages.
Attack Vector
An attacker with administrator credentials on a multi-site installation, or on a site where unfiltered_html has been disabled, navigates to the plugin's settings page and submits a payload containing JavaScript within a field intended for text or configuration data. The payload is stored and later executed whenever a user, including higher-privileged super administrators, loads a page that renders the setting. The scope change (S:C in the CVSS vector) reflects that scripts executing in one user's session can affect other users' sessions.
No public proof-of-concept or exploitation in the wild has been reported for this vulnerability.
Detection Methods for CVE-2025-12393
Indicators of Compromise
- Unexpected <script> tags, event handlers such as onerror= or onload=, or encoded JavaScript strings stored in wp_options rows associated with the Free Quotation plugin.
- Outbound requests from visitor browsers to unfamiliar third-party domains after loading pages that render plugin settings.
- Newly created administrator accounts or modified user roles following administrator sessions on affected sites.
Detection Strategies
- Audit the wp_options and plugin-specific tables for entries containing HTML tags or JavaScript keywords in fields that should hold plain text.
- Compare the installed plugin version against the fixed release; any version <= 3.1.6 on a multi-site installation is exposed.
- Review web server access logs for POST requests to the plugin's settings endpoints originating from administrator accounts, correlating with subsequent anomalous script loads.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on admin and public pages.
- Alert on changes to WordPress plugin settings tables using file integrity or database change monitoring.
- Monitor administrator login activity on multi-site networks and flag session anomalies from unfamiliar IP addresses or user agents.
How to Mitigate CVE-2025-12393
Immediate Actions Required
- Update the Free Quotation plugin to a version later than 3.1.6 once the vendor releases a patched build.
- Restrict administrator access on multi-site networks to trusted users only and enforce strong authentication with multi-factor authentication (MFA).
- Audit plugin settings for existing injected payloads and remove any unauthorized markup before restoring normal operation.
Patch Information
At the time of publication, refer to the WordPress plugin page for Free Quotation for the latest available version and changelog. Additional technical details are available in the Wordfence vulnerability report. Apply the fixed release across all sites in a multi-site network.
Workarounds
- Deactivate and remove the Free Quotation plugin until a fixed version is installed.
- On multi-site networks, limit which site administrators can activate or configure the plugin using network-level plugin management controls.
- Deploy a web application firewall (WAF) rule that blocks HTML and script tags submitted to the plugin's settings endpoints.
# Configuration example: identify vulnerable installs via WP-CLI
wp plugin list --field=name,version | grep free-quotation
wp plugin update free-quotation --network
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
