CVE-2025-12660: Padlet Shortcode WordPress Plugin XSS Flaw

CVE-2025-12660 Overview

The Padlet Shortcode (Wallwisher) plugin for WordPress contains a Stored Cross-Site Scripting vulnerability [CWE-79] affecting all versions up to and including 1.3. The flaw resides in the key parameter of the wallwisher shortcode. Insufficient input sanitization and output escaping on user-supplied shortcode attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript into posts and pages. Injected scripts execute in the browser context of any user who views the affected content, including site administrators. This enables session hijacking, credential theft, and administrative account takeover through crafted payloads delivered via a legitimate WordPress feature.

Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that execute against every visitor, including administrators, enabling privilege escalation and site compromise.

Affected Products

Padlet Shortcode (Wallwisher) plugin for WordPress, versions up to and including 1.3
WordPress sites permitting contributor-level or higher registrations
Any WordPress instance rendering the wallwisher shortcode in published content

Discovery Timeline

2025-11-21 - CVE-2025-12660 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-12660

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the WordPress shortcode handler for the Padlet (Wallwisher) plugin. When a contributor or higher-privileged user embeds the wallwisher shortcode in a post, the plugin accepts a key attribute intended to reference a Padlet board identifier. The plugin embeds this attribute directly into the page's rendered HTML without applying proper output escaping such as esc_attr() or esc_url(). An attacker supplies a payload that breaks out of the attribute context and injects arbitrary script tags or event handlers. The malicious content persists in the WordPress database and executes each time the page is rendered in a visitor's browser.

Because exploitation only requires contributor privileges, any site that accepts guest authors, freelance contributors, or self-registered contributor accounts is exposed. Successful exploitation against a logged-in administrator can result in nonce theft, unauthorized plugin installation, or account creation. See the Wordfence Vulnerability Analysis #09989141 for additional technical context.

Root Cause

The root cause is missing input sanitization and output escaping on the key shortcode attribute inside wallwisher.php. The plugin trusts contributor-supplied shortcode parameters and concatenates them into HTML output. The relevant code path is visible in the WordPress Wallwisher Code Reference. WordPress requires esc_attr() for HTML attribute contexts, which is absent here.

Attack Vector

An authenticated contributor drafts a post containing the wallwisher shortcode and supplies a crafted key value that closes the surrounding attribute and appends a script payload or event handler. Once the post is previewed or published and viewed by an editor, administrator, or site visitor, the browser executes the attacker-controlled JavaScript in the site's origin. No user interaction beyond visiting the page is required. Refer to the WordPress Wallwisher Plugin Page for plugin distribution details.

Detection Methods for CVE-2025-12660

Indicators of Compromise

Posts or pages containing [wallwisher ...] shortcodes with unexpected characters such as ", <, >, onerror=, or javascript: in the key attribute
Unexpected <script> tags or inline event handlers appearing in rendered post HTML that reference external attacker-controlled domains
New administrator accounts, plugin installations, or option changes performed by sessions originating from post preview or view activity
Contributor accounts submitting posts that repeatedly invoke the wallwisher shortcode with atypical parameters

Detection Strategies

Query the wp_posts table for post_content matching the wallwisher shortcode combined with suspicious characters in the key attribute
Review the plugin's rendered output on staging environments and compare against expected key value patterns (typically short alphanumeric Padlet IDs)
Enable WordPress audit logging to correlate contributor post submissions with subsequent administrator session anomalies

Monitoring Recommendations

Alert on outbound requests from browsers loading WordPress pages to unknown domains, indicating potential script exfiltration
Monitor WordPress REST API and admin-ajax endpoints for privilege changes following contributor content submissions
Track plugin version inventory across managed WordPress sites to identify installations still running Padlet Shortcode 1.3 or earlier

How to Mitigate CVE-2025-12660

Immediate Actions Required

Deactivate and remove the Padlet Shortcode (Wallwisher) plugin until a patched release is confirmed available
Audit all posts and pages containing the [wallwisher] shortcode and remove entries with suspicious key attribute values
Review contributor and author accounts, revoking access for untrusted or inactive users
Rotate administrator session cookies and passwords if suspicious activity is detected in audit logs

Patch Information

At the time of NVD publication, all versions up to and including 1.3 are affected. Monitor the WordPress Wallwisher Plugin Page for a patched release that adds esc_attr() sanitization to the key attribute. Apply the fixed version across all WordPress sites once available.

Workarounds

Restrict shortcode usage by removing the wallwisher shortcode registration through a must-use plugin until an update ships
Enforce least privilege by limiting contributor role assignments and requiring editor approval before publishing contributor content
Deploy a Web Application Firewall (WAF) rule that blocks requests containing wallwisher shortcodes with <, >, or javascript: characters in attributes
Apply Content Security Policy (CSP) headers that restrict inline script execution and limit allowed script sources

bash

# Example: remove the vulnerable shortcode via a must-use plugin
# File: wp-content/mu-plugins/disable-wallwisher.php
<?php
add_action('init', function () {
    remove_shortcode('wallwisher');
}, 20);