CVE-2025-12499 Overview
CVE-2025-12499 is a Stored Cross-Site Scripting (XSS) vulnerability in the Rich Shortcodes for Google Reviews plugin for WordPress. The flaw affects all versions up to and including 6.8 and stems from insufficient input sanitization and output escaping of Google Review content rendered by the plugin. Unauthenticated attackers can inject arbitrary web scripts that execute whenever a user visits an affected page. The issue was partially addressed in version 6.6.2 but not fully remediated in the analyzed versions. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browser of every visitor to affected WordPress pages, enabling session theft, redirection, and administrative account compromise.
Affected Products
- Rich Shortcodes for Google Reviews plugin for WordPress (all versions through 6.8)
- WordPress sites using the widget-google-reviews plugin
- Versions prior to and including 6.8 (partial patch shipped in 6.6.2)
Discovery Timeline
- 2025-12-06 - CVE-2025-12499 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-12499
Vulnerability Analysis
The Rich Shortcodes for Google Reviews plugin fetches and renders the contents of Google Reviews on WordPress pages through shortcode-driven widgets. The plugin fails to sufficiently sanitize incoming review content and does not escape that content when writing it to the page DOM. As a result, any HTML or JavaScript embedded within a review body is rendered as live markup in the visitor's browser. Because reviews originate from an external source rather than authenticated WordPress users, the attack does not require any local account or credentials on the WordPress site.
This is a classic Stored XSS issue: malicious payloads persist via the upstream review content and are reflected each time the plugin renders the review block. The partial fix in version 6.6.2 addressed some review fields but left additional sinks unescaped, which is why versions through 6.8 remain exploitable.
Root Cause
The root cause is missing output escaping on review text rendered by the shortcode. WordPress provides escaping helpers such as esc_html(), esc_attr(), and wp_kses_post() that should be applied to any externally sourced data before it is emitted into HTML context. The plugin trusts the structure of review content returned by upstream APIs and writes it directly into the rendered widget markup.
Attack Vector
Exploitation requires an attacker to influence the content of a Google Review that is then pulled into the affected WordPress site through the plugin's shortcode. When a victim browses any page containing the rendered review shortcode, the injected script executes in their browser within the origin of the WordPress site. Because the scope is changed (S:C in the CVSS vector), the impact can extend beyond the vulnerable component to the visitor's session context. Successful exploitation can be used to hijack administrator sessions, perform actions on behalf of logged-in users, deliver malware, or redirect visitors to attacker-controlled infrastructure.
No verified public proof-of-concept code is available. See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2025-12499
Indicators of Compromise
- Presence of <script>, onerror=, onload=, or javascript: strings inside rendered Google Review widgets on WordPress pages.
- Unexpected outbound requests from visitor browsers to unknown third-party domains originating from pages containing the widget-google-reviews shortcode.
- Unauthorized administrator account creation or modification following visits by privileged users to pages displaying review widgets.
Detection Strategies
- Inventory WordPress installations and identify any using the widget-google-reviews plugin at version 6.8 or earlier.
- Inspect the rendered HTML of pages containing review shortcodes for HTML tags or event handlers within review text fields.
- Review web server access logs for anomalous referrer patterns or requests originating from review widget pages immediately preceding privileged account changes.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) in report-only mode to surface script execution from unexpected inline sources on pages rendering reviews.
- Monitor WordPress audit logs for new admin users, role changes, or plugin installations that follow page visits by authenticated administrators.
- Alert on browser console errors or CSP violations reported via report-uri for pages that include the Google Reviews shortcode.
How to Mitigate CVE-2025-12499
Immediate Actions Required
- Identify all WordPress sites running the Rich Shortcodes for Google Reviews (widget-google-reviews) plugin and confirm the installed version.
- Disable or remove the plugin on any site running version 6.8 or earlier until a fully patched release is installed.
- Audit administrator accounts and recent plugin or theme changes on affected sites for signs of compromise.
Patch Information
The vendor shipped a partial fix in version 6.6.2 and additional changes tracked in the WordPress plugin repository. Review the upstream changesets at WordPress Changeset 3389203 and WordPress Changeset 3411521, and upgrade to the latest available release. Until a confirmed full fix is published, treat all versions through 6.8 as vulnerable.
Workarounds
- Remove the plugin's shortcodes from public-facing pages until a fully patched version is available.
- Apply a restrictive Content Security Policy that blocks inline scripts on pages rendering review content.
- Place the affected WordPress site behind a Web Application Firewall (WAF) with rules that strip HTML tags and event handlers from review payloads before they reach the browser.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
