CVE-2025-12658 Overview
The Preload Current Images plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 1.3. The flaw resides in the complete parameter of the preload_progress_bar shortcode, which fails to properly sanitize user-supplied attributes or escape output. Authenticated attackers holding contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, enabling session theft, redirection, or actions performed on behalf of the visitor.
Critical Impact
Contributor-level accounts can persist arbitrary JavaScript in published content, executing in the context of site visitors and administrators.
Affected Products
- Preload Current Images plugin for WordPress (versions ≤ 1.3)
- WordPress sites permitting contributor-level or higher registration
- Any WordPress installation using the preload_progress_bar shortcode
Discovery Timeline
- 2025-11-11 - CVE-2025-12658 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12658
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the preload_progress_bar shortcode handler. When a contributor or higher-privileged user embeds the shortcode in a post or page, the plugin passes the complete attribute directly into rendered HTML output without sanitization or escaping. The payload persists in the WordPress database and executes each time the containing page is rendered in a visitor's browser. The scope-changed CVSS vector reflects that script execution occurs in a security context different from the injecting user, affecting site administrators and unauthenticated visitors alike.
Root Cause
The plugin's shortcode callback accepts the complete attribute from user input and injects it into HTML markup without applying WordPress escaping functions such as esc_attr() or esc_html(). Input validation is also missing, so no character filtering restricts the payload. This combination of insufficient input sanitization and missing output escaping enables persistent script injection through legitimate shortcode usage.
Attack Vector
An authenticated attacker with contributor privileges creates or edits a post containing the preload_progress_bar shortcode. The attacker supplies a malicious JavaScript payload in the complete attribute. Once the post is published or previewed by an editor or administrator, the browser parses the unsanitized attribute and executes the injected script. Successful exploitation can hijack administrator sessions, escalate privileges through forced actions, or redirect visitors to attacker-controlled infrastructure.
Code examples are unavailable for this advisory. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the affected shortcode implementation.
Detection Methods for CVE-2025-12658
Indicators of Compromise
- Posts or pages containing [preload_progress_bar] shortcodes with unusual complete attribute values including <script>, onerror=, or javascript: payloads.
- Unexpected outbound requests from administrator browsers to unknown domains after viewing content authored by contributors.
- Newly created administrator accounts or modified user roles that correlate with recent contributor activity.
Detection Strategies
- Query the wp_posts table for shortcode instances containing angle brackets, on*= event handlers, or encoded script tags in shortcode attributes.
- Monitor WordPress audit logs for contributor-level users creating or editing posts containing the vulnerable shortcode.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from post content.
Monitoring Recommendations
- Alert on new post publications by contributor accounts pending editor review.
- Log and inspect all shortcode rendering events server-side for anomalous attribute payloads.
- Track administrator session cookies for reuse from unexpected IP addresses following content review activity.
How to Mitigate CVE-2025-12658
Immediate Actions Required
- Update the Preload Current Images plugin to a patched release once available, or deactivate and remove the plugin from all WordPress installations.
- Audit existing posts and pages for the preload_progress_bar shortcode and inspect all complete attribute values for injected script content.
- Restrict contributor and author registrations until the plugin is patched or removed.
Patch Information
At the time of publication, no fixed version beyond 1.3 is referenced in the Wordfence Vulnerability Report. Administrators should monitor the WordPress Preload Current Images plugin page for security updates and apply them immediately upon release.
Workarounds
- Remove or deactivate the Preload Current Images plugin until a patched version is published.
- Revoke publishing and shortcode privileges from untrusted contributor accounts using role management tools.
- Deploy a web application firewall rule blocking shortcode attribute values containing HTML tags, event handlers, or javascript: URIs.
- Enforce a strict Content Security Policy that disallows inline script execution to limit the impact of injected payloads.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate preload-current-images
wp plugin delete preload-current-images
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
