CVE-2025-12651: Live Photos WordPress Plugin XSS Vulnerability

CVE-2025-12651 Overview

CVE-2025-12651 is a Stored Cross-Site Scripting (XSS) vulnerability in the Live Photos on WordPress plugin. The flaw affects all versions up to and including 0.1. It stems from insufficient input sanitization and output escaping on the video_src, img_src, and class parameters within the livephotos_photo shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into posts and pages. The injected scripts execute in the browser of any visitor who views the affected content. The weakness is classified as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can store malicious JavaScript in WordPress pages, enabling session theft, administrative action abuse, and arbitrary redirection against site visitors and administrators.

Affected Products

Live Photos on WordPress plugin — all versions through 0.1
WordPress sites allowing contributor-level or higher accounts to publish shortcode-enabled content
Any WordPress environment where the plugin is installed and active

Discovery Timeline

2025-11-11 - CVE-2025-12651 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-12651

Vulnerability Analysis

The Live Photos on WordPress plugin registers a shortcode named livephotos_photo that renders HTML output using attributes supplied by the content author. The shortcode handler, defined in core/class-livephotos-shortcodes.php, accepts the video_src, img_src, and class attributes and embeds them directly into the generated markup. The plugin does not apply WordPress escaping functions such as esc_url(), esc_attr(), or wp_kses() before output. This allows attacker-controlled strings to break out of HTML attribute contexts and introduce executable script content. Because the payload is persisted in post content, every visitor who loads the page triggers execution. Stored XSS of this kind can be leveraged to hijack administrator sessions, create rogue accounts, or chain into further compromise of the WordPress installation.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes. User-supplied values are concatenated into HTML without validation of URL schemes or neutralization of HTML metacharacters. Contributor accounts, which can draft content containing shortcodes, inherit the ability to inject arbitrary HTML through this parameter path.

Attack Vector

An authenticated attacker holding at least contributor privileges creates or edits a post containing the livephotos_photo shortcode. The attacker places a payload inside one of the vulnerable attributes, such as a javascript: URL in video_src or img_src, or an attribute-breaking string in class. When an editor, administrator, or site visitor opens the rendered page, the browser executes the injected script in the WordPress origin. See the Wordfence vulnerability analysis and the plugin source reference for the affected code path.

Detection Methods for CVE-2025-12651

Indicators of Compromise

Post or page content containing [livephotos_photo] shortcodes with javascript: schemes or inline event handlers in the video_src, img_src, or class attributes.
Unexpected <script> tags, onerror, or onload handlers appearing in rendered pages that use the Live Photos shortcode.
Creation of new administrator accounts or modification of user roles shortly after a contributor publishes shortcode-bearing content.

Detection Strategies

Query the wp_posts table for post_content containing livephotos_photo combined with suspicious attribute values such as javascript:, onerror=, or <script.
Review web server access logs for requests to pages containing the shortcode followed by outbound requests to unfamiliar domains, suggesting data exfiltration from executed scripts.
Monitor WordPress audit logs for post edits performed by contributor-level accounts that introduce shortcodes.

Monitoring Recommendations

Enable a web application firewall ruleset that inspects shortcode attributes for XSS payload patterns.
Alert on administrative actions, such as user creation or plugin installation, that originate from browser sessions immediately after viewing contributor-authored pages.
Track plugin inventory to flag Live Photos on WordPress installations at version 0.1 or earlier.

How to Mitigate CVE-2025-12651

Immediate Actions Required

Deactivate and uninstall the Live Photos on WordPress plugin until a patched release is published and verified.
Audit all existing posts and pages for livephotos_photo shortcodes and remove any instances containing suspicious attribute values.
Restrict contributor and author role assignments to trusted users, and review the list of accounts holding those roles.

Patch Information

No fixed version is identified in the NVD record at the time of publication. All versions through 0.1 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for an updated release and apply it as soon as it becomes available.

Workarounds

Remove the plugin entirely if a patch is not yet available, since the vulnerable shortcode is only exposed while the plugin is active.
Deploy a web application firewall rule that blocks livephotos_photo shortcode submissions containing javascript:, data:, or HTML event handler patterns.
Temporarily revoke shortcode privileges from contributor accounts by filtering the_content or using a role management plugin to prevent unsanitized shortcode use.

bash

# Configuration example: locate vulnerable shortcode usage in the WordPress database
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[livephotos_photo%' \
  AND (post_content LIKE '%javascript:%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%<script%');

# Disable the plugin until a patched version is available
wp plugin deactivate live-photos
wp plugin delete live-photos