CVE-2025-12652 Overview
The Ungapped Widgets plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. The flaw resides in the prefillvalues parameter of the ungapped-form shortcode. All versions up to and including version 1 are affected.
The plugin fails to sanitize user-supplied attributes and does not escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, credential harvesting, and administrative action hijacking.
Affected Products
- WordPress Ungapped Widgets plugin, all versions up to and including 1
- WordPress sites allowing contributor-level user registration
- WordPress deployments using the ungapped-form shortcode
Discovery Timeline
- 2025-11-11 - CVE-2025-12652 published to NVD
- 2026-10-18 - Last updated in NVD database
Technical Details for CVE-2025-12652
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw in the ungapped-form shortcode handler. The plugin accepts a prefillvalues attribute intended to populate form fields with default content. The handler passes this attribute directly into rendered HTML without sanitization or escaping.
An attacker with contributor privileges can craft a post or page that embeds the shortcode with malicious JavaScript inside the prefillvalues attribute. When any user requests that page, the browser parses the attacker-controlled markup and executes the script in the context of the site's origin.
Because the payload persists in the database, exploitation does not require social engineering of individual victims. Any logged-in administrator reviewing a contributor submission becomes a viable target for session takeover.
Root Cause
The root cause is insufficient input validation combined with missing output escaping on shortcode attributes. The plugin should apply esc_attr(), esc_html(), or wp_kses() when rendering user-supplied data. The affected code path lives in ungapped-widgets-plugin.php as documented in the plugin trac.
Attack Vector
Exploitation requires network access to the WordPress site and authenticated access at contributor level or above. The attacker creates or edits a post containing the ungapped-form shortcode with a JavaScript payload in the prefillvalues attribute. The payload executes when the post is rendered, including in editor previews used by reviewers and administrators.
See the Wordfence Vulnerability Report and the WordPress Ungapped Widgets Plugin source for the affected code location.
Detection Methods for CVE-2025-12652
Indicators of Compromise
- Posts or pages containing ungapped-form shortcodes with prefillvalues attributes referencing <script>, javascript:, or event handlers such as onerror and onload
- Unexpected contributor accounts creating or editing posts that embed the shortcode
- Outbound requests from site visitors to attacker-controlled domains originating from WordPress pages
Detection Strategies
- Audit the wp_posts table for shortcode instances containing suspicious attribute values or HTML tags inside prefillvalues
- Monitor WordPress audit logs for post creation and revision events by contributor accounts
- Deploy a web application firewall rule to flag shortcode attributes containing script tags or HTML event handlers
Monitoring Recommendations
- Alert on anomalous JavaScript execution and cookie access on pages rendered to administrators
- Correlate contributor publishing activity with subsequent administrator page views to identify targeted exploitation
- Ingest WordPress and web server logs into a centralized analytics platform for retrospective hunting
How to Mitigate CVE-2025-12652
Immediate Actions Required
- Deactivate and remove the Ungapped Widgets plugin until a patched version is published
- Review all posts and pages for malicious ungapped-form shortcode content and purge affected entries
- Restrict contributor-level account creation and audit existing contributor accounts for legitimacy
- Force password resets for administrator accounts that may have viewed exploited pages
Patch Information
No patched version has been identified in the available advisories. All versions up to and including 1 remain affected. Monitor the WordPress plugin repository and the Wordfence advisory for updates.
Workarounds
- Remove the plugin entirely if the form functionality is not business-critical
- Restrict user registration to trusted individuals and demote existing contributor accounts where feasible
- Implement a Content Security Policy (CSP) that blocks inline scripts to limit payload execution
- Deploy WAF rules that reject requests containing script tags or event handlers inside shortcode attributes
# Disable the plugin via WP-CLI
wp plugin deactivate ungapped-widgets
wp plugin delete ungapped-widgets
# Search the database for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%ungapped-form%' AND post_content LIKE '%prefillvalues%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
