CVE-2025-12643: Saphali LiqPay WordPress Plugin XSS Flaw

CVE-2025-12643 Overview

The Saphali LiqPay for donate plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the saphali_liqpay shortcode. The flaw affects all plugin versions up to and including 1.0.2. Insufficient input sanitization and output escaping on user-supplied shortcode attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. The injected scripts execute in the browser of any user who views the affected page. This vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, forced actions, and site takeover through admin-context script execution.

Affected Products

Saphali LiqPay for donate plugin for WordPress — all versions through 1.0.2
WordPress sites permitting contributor-level or higher registration
Sites embedding the saphali_liqpay shortcode on public-facing pages

Discovery Timeline

2025-11-08 - CVE-2025-12643 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12643

Vulnerability Analysis

The vulnerability resides in the saphali_liqpay shortcode handler defined in liqpay-d.php. When WordPress processes the shortcode, the plugin passes user-supplied attributes into the rendered HTML without applying proper sanitization functions such as esc_attr() or wp_kses(). Because contributors can author posts containing shortcodes, any user at that role or higher can craft attributes that break out of the intended HTML context and inject arbitrary JavaScript.

The stored nature of the flaw means the payload persists in the post content and executes each time the page renders. If an administrator previews or reviews a contributor's submission, the script runs with administrator session context. This enables actions such as creating new administrator accounts, modifying plugin files, or exfiltrating authentication cookies. Refer to the WordPress plugin source snapshot and the Wordfence vulnerability report for further technical details.

Root Cause

The root cause is missing input sanitization and output escaping on shortcode attributes processed by the plugin. WordPress provides escaping helpers for attribute contexts, but the vulnerable code path emits attribute values directly into HTML. This omission allows attribute payloads containing quote characters and event handlers to escape the intended context.

Attack Vector

An attacker requires an authenticated WordPress account at the contributor role or higher. The attacker creates a post or page containing the saphali_liqpay shortcode with a malicious attribute value carrying JavaScript. When any visitor, editor, or administrator views the rendered content, the script executes in their browser session. No user interaction beyond page load is required.

No verified public exploit code is available. The vulnerability mechanism is described in the WordPress plugin change set that introduced the fix.

Detection Methods for CVE-2025-12643

Indicators of Compromise

Post or page content containing saphali_liqpay shortcode attributes with <script>, javascript:, or event handlers such as onerror= and onload=
Unexpected administrator or editor account creations following contributor post submissions
Outbound requests from administrator browsers to unfamiliar domains after viewing contributor-authored content
Modified WordPress options or plugin files without a corresponding administrator action in audit logs

Detection Strategies

Query the wp_posts table for post_content containing saphali_liqpay and inspect attribute values for HTML control characters
Review WordPress audit logs for contributor role assignments and post submissions coinciding with administrator session anomalies
Enforce a Content Security Policy (CSP) that blocks inline scripts and log CSP violation reports for the affected pages

Monitoring Recommendations

Monitor plugin installations and versions across managed WordPress deployments and flag Saphali LiqPay for donate at or below 1.0.2
Alert on new user registrations at contributor role or higher, particularly on sites without editorial workflows
Track shortcode usage patterns and inspect attribute payloads submitted by non-administrator authors

How to Mitigate CVE-2025-12643

Immediate Actions Required

Update the Saphali LiqPay for donate plugin to a version above 1.0.2 that includes the fix from changeset 3391235
Audit contributor and author accounts and remove any that are inactive or unrecognized
Review recently submitted posts and pages for the saphali_liqpay shortcode and inspect attribute values for injected script content
Rotate administrator credentials and invalidate active sessions if suspicious contributor activity is identified

Patch Information

The vendor addressed the vulnerability in the plugin update referenced by the WordPress plugin change set. Site operators should upgrade through the WordPress plugin manager or by replacing plugin files with the patched release. Verify installation by confirming the plugin version reported in the WordPress admin dashboard is greater than 1.0.2.

Workarounds

Deactivate and remove the Saphali LiqPay for donate plugin until an upgrade can be applied
Restrict contributor-level and higher registrations by disabling open registration and requiring administrator approval
Deploy a web application firewall rule that blocks requests containing saphali_liqpay shortcode attributes with script tags or event handler keywords
Enforce a strict Content Security Policy that disallows inline JavaScript execution on published pages

bash

# WP-CLI example: identify vulnerable plugin version and force upgrade
wp plugin get saphali-liqpay-for-donate --field=version
wp plugin update saphali-liqpay-for-donate
wp user list --role=contributor --fields=ID,user_login,user_registered