CVE-2025-12667: GitHub Gist Shortcode Plugin XSS Flaw

CVE-2025-12667 Overview

The GitHub Gist Shortcode Plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the id parameter of the gist shortcode. The flaw affects all versions up to and including 0.2. The plugin fails to perform sufficient input sanitization and output escaping on shortcode attributes. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who views the affected page. The issue is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can store malicious scripts that execute against site visitors and administrators, enabling session theft, account takeover, and site defacement.

Affected Products

GitHub Gist Shortcode Plugin for WordPress — all versions through 0.2
WordPress sites allowing Contributor-level or higher user registration
Any WordPress installation rendering the gist shortcode from untrusted authors

Discovery Timeline

2025-11-11 - CVE-2025-12667 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-12667

Vulnerability Analysis

The vulnerability resides in the shortcode handler for the gist shortcode within github-gist-shortcode-plugin.php. The handler accepts an id attribute supplied by any user able to author content. The plugin passes this attribute directly into generated HTML output without applying esc_attr(), esc_url(), or equivalent WordPress escaping functions. An attacker can break out of the attribute context and inject arbitrary script tags or event handlers. The stored payload executes every time a visitor loads the page containing the shortcode.

Because WordPress Contributors can create draft posts, the attack surface extends to any site that permits contributor registration or has existing low-privileged accounts. The scope change reflected in the vulnerability metrics indicates the injected script runs in the context of the site origin, which can affect administrator sessions reviewing contributor drafts.

Root Cause

The root cause is missing input validation and output escaping on shortcode attributes. WordPress provides shortcode_atts() for attribute parsing, but defensive escaping of each value prior to HTML emission is the developer's responsibility. The plugin interpolates the id attribute into markup without encoding, allowing shortcode payloads such as [gist id="\" onerror=... "] to break the attribute boundary.

Attack Vector

Exploitation requires authentication at the Contributor role or higher. The attacker creates or edits a post containing a crafted gist shortcode with a malicious id value. When any user — including an editor reviewing the draft or a visitor viewing the published post — renders the page, the injected JavaScript executes under the site's origin. See the plugin source code referenced in the advisory and the Wordfence vulnerability report for technical details.

// No verified exploit code is published. The vulnerable pattern follows the form:
// [gist id="<attacker-controlled value breaking out of the attribute>"]
// which is rendered into HTML without escaping, producing executable script in the response.

Detection Methods for CVE-2025-12667

Indicators of Compromise

Posts or drafts containing gist shortcodes with unusual id values that include quotes, angle brackets, or JavaScript keywords such as onerror, onload, or <script>.
Outbound requests from visitor browsers to attacker-controlled domains after rendering a page containing a gist shortcode.
Unexpected administrative actions originating from sessions that recently viewed contributor-authored drafts.

Detection Strategies

Query the wp_posts table for post_content entries containing [gist and inspect each id attribute for non-alphanumeric characters outside the expected Gist ID format.
Deploy a web application firewall rule that inspects POST requests to wp-admin/post.php for shortcode attributes containing HTML or script syntax.
Review browser Content Security Policy violation reports for inline-script or event-handler blocks on pages that embed the shortcode.

Monitoring Recommendations

Monitor creation of new Contributor accounts and audit post revisions submitted by low-privileged users.
Alert on administrator sessions that execute privileged actions immediately after previewing contributor drafts.
Track plugin inventory and flag any WordPress site still running GitHub Gist Shortcode Plugin version 0.2 or earlier.

How to Mitigate CVE-2025-12667

Immediate Actions Required

Deactivate and remove the GitHub Gist Shortcode Plugin until a patched release is available, since all versions through 0.2 are affected.
Audit existing posts and drafts for the gist shortcode and remove or sanitize any entries authored by non-trusted users.
Restrict Contributor-level registrations and review existing low-privileged accounts for legitimacy.

Patch Information

As of the last NVD update on 2026-10-07, no fixed version has been published. The vulnerability affects all versions up to and including 0.2. Monitor the plugin page on WordPress.org and the Wordfence advisory for a patched release.

Workarounds

Replace the plugin with an alternative Gist embedding solution that properly escapes shortcode attributes.
Apply a web application firewall rule blocking gist shortcode attributes containing characters outside the expected Gist ID character set ([A-Za-z0-9]).
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized third-party script sources.
Limit shortcode usage to Editor or Administrator roles using a role-management plugin or custom capability check.

bash

# Example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate github-gist-shortcode
wp plugin delete github-gist-shortcode

# Example: identify posts that use the vulnerable shortcode
wp db query "SELECT ID, post_title, post_status, post_author FROM wp_posts WHERE post_content LIKE '%[gist%';"