CVE-2025-12666: WordPress Google Drive Plugin XSS Flaw

CVE-2025-12666 Overview

CVE-2025-12666 is a stored cross-site scripting (XSS) vulnerability in the Google Drive upload and download link plugin for WordPress. The flaw affects all versions up to and including 1.0. It stems from insufficient input sanitization and output escaping of the link parameter in the atachfilegoogle shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any user viewing an affected page. The issue is tracked under CWE-79 and is documented in the Wordfence Vulnerability Analysis.

Critical Impact
Authenticated Contributor-level users can persist malicious JavaScript in WordPress pages, leading to session theft, administrative account takeover, and site defacement when administrators view the injected content.

Affected Products

Google Drive upload and download link WordPress plugin, all versions up to and including 1.0
WordPress sites permitting Contributor-level (or higher) user registration with this plugin active
Any downstream content consumers rendering pages containing the atachfilegoogle shortcode

Discovery Timeline

2025-11-27 - CVE-2025-12666 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12666

Vulnerability Analysis

The plugin registers a WordPress shortcode named atachfilegoogle that accepts a user-supplied link attribute. The shortcode handler embeds this attribute directly into HTML output without escaping it through a WordPress sanitization API such as esc_url(), esc_attr(), or wp_kses(). When a Contributor edits a post or page and includes the shortcode with a crafted link value, the payload persists in the post content stored in the database. Any visitor rendering that page executes the injected script under the site's origin. See the vulnerable code path in the plugin source for reference.

Root Cause

The shortcode callback concatenates the raw link attribute value into an HTML anchor or attribute context. WordPress passes shortcode attributes to callbacks as untrusted strings. Without an escaping call at the output boundary, an attacker can break out of the intended attribute or element and inject <script> tags or event handlers such as onerror and onmouseover.

Attack Vector

Exploitation requires an authenticated account with the Contributor role or above. The attacker creates or edits a post containing the shortcode with a malicious link value. The payload triggers when the post is previewed by an editor for approval, viewed by administrators in the dashboard preview, or published and rendered to site visitors. Because injected script runs in the origin of the WordPress site, attackers can steal authentication cookies, force privilege changes via administrator-authenticated AJAX requests, or plant persistent backdoors through the theme or plugin editor.

No verified public exploit code has been published. Technical detail on the vulnerable output path is available in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-12666

Indicators of Compromise

Post or page content in the wp_posts table containing [atachfilegoogle shortcodes with link values that include <script, javascript:, onerror=, or other HTML/JS control characters.
Newly created administrator or editor accounts following Contributor account activity on sites running the plugin.
Unexpected modifications to theme files, plugin files, or the wp_options table (for example, siteurl, home, or active_plugins) originating from administrator sessions.

Detection Strategies

Query stored post content for the atachfilegoogle shortcode and inspect link attribute values for HTML tags, event handlers, or URL schemes other than http/https.
Deploy a web application firewall rule that inspects POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php for shortcode payloads carrying script content.
Monitor WordPress audit logs for Contributor accounts publishing or updating posts containing the shortcode.

Monitoring Recommendations

Enable WordPress activity logging to correlate low-privilege user edits with subsequent administrator sessions.
Alert on outbound requests from browsers on the site origin toward unfamiliar domains, which can indicate cookie exfiltration from injected scripts.
Track file integrity for wp-content/themes/ and wp-content/plugins/ directories to identify post-exploitation backdoor placement.

How to Mitigate CVE-2025-12666

Immediate Actions Required

Deactivate and remove the Google Drive upload and download link plugin until a patched version is published.
Audit posts and pages for existing atachfilegoogle shortcodes and remove entries containing untrusted markup in the link attribute.
Rotate credentials and session tokens for administrator and editor accounts if the plugin has been active with untrusted Contributor accounts.

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed version has been indicated for the Google Drive upload and download link plugin. All versions through 1.0 remain vulnerable. Monitor the plugin's WordPress.org listing and the Wordfence advisory for a patched release.

Workarounds

Restrict Contributor-and-above registration on public WordPress sites; require manual account provisioning.
Apply a WAF rule that blocks requests submitting atachfilegoogle shortcodes containing <, >, or javascript: sequences in the link attribute.
Configure a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to reduce impact of stored XSS payloads.

bash

# Example: locate vulnerable shortcode usage in the WordPress database
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%[atachfilegoogle%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%javascript:%' \
       OR post_content LIKE '%onerror=%');