CVE-2025-12710 Overview
The Pet-Manager – Petfinder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the kwm-petfinder shortcode. The flaw affects all versions up to and including 3.6.1. The plugin fails to sanitize user-supplied attributes and does not escape output correctly. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page. This vulnerability is tracked under CWE-79.
Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, credential harvesting, or administrative account takeover when viewed by higher-privileged users.
Affected Products
- Pet-Manager – Petfinder plugin for WordPress
- All versions up to and including 3.6.1
- WordPress installations with Contributor-level users or above
Discovery Timeline
- 2025-11-19 - CVE-2025-12710 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12710
Vulnerability Analysis
The vulnerability resides in the kwm-petfinder shortcode handler within kwm-petfinder.php. The plugin accepts attributes passed through the shortcode without applying WordPress sanitization functions such as sanitize_text_field() or esc_attr(). When the shortcode is rendered, attacker-controlled values are inserted directly into HTML output. This allows arbitrary script content to reach the Document Object Model (DOM).
Affected code paths are referenced in the plugin source at lines 133, 163, and 164 of the 3.6.1 release. The Wordfence advisory documents the specific attribute handling issue. Because the shortcode output is persisted within post or page content, the payload executes for every visitor who loads the affected content.
Root Cause
The root cause is insufficient input validation combined with missing output escaping. The plugin trusts shortcode attribute values supplied by authenticated users and echoes them directly into HTML attributes and body content. WordPress provides context-specific escaping helpers such as esc_html(), esc_attr(), and wp_kses(), none of which are applied to the vulnerable attributes.
Attack Vector
An attacker must first obtain Contributor-level access or higher on the target WordPress site. The attacker then creates or edits a post containing the kwm-petfinder shortcode with a malicious attribute value carrying JavaScript. Once a reviewer, editor, or administrator previews or publishes the post, the payload executes in their authenticated session. See the WordPress plugin source for the unsanitized handler.
The vulnerability manifests when shortcode attributes are echoed without escaping. Refer to the vendor changeset for the specific handler logic; no verified public exploit code is available.
Detection Methods for CVE-2025-12710
Indicators of Compromise
- Post or page content containing [kwm-petfinder] shortcodes with attributes holding <script>, onerror, onload, or javascript: payloads.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting content that renders the plugin shortcode.
- New administrator accounts or role changes shortly after a contributor publishes or edits content using the plugin.
Detection Strategies
- Audit the WordPress wp_posts table for shortcode instances of kwm-petfinder and inspect attribute values for HTML or JavaScript characters.
- Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to /wp-admin/post.php for suspicious shortcode attribute patterns.
- Enable WordPress activity logging to correlate content edits from contributor accounts with subsequent privileged user sessions.
Monitoring Recommendations
- Monitor Content Security Policy (CSP) violation reports for inline script executions on pages rendered by the plugin.
- Track login events and privilege changes for editor and administrator accounts following contributor content submissions.
- Alert on modifications to WordPress user roles or the wp_options table entry active_plugins for tampering attempts.
How to Mitigate CVE-2025-12710
Immediate Actions Required
- Update the Pet-Manager – Petfinder plugin to a version newer than 3.6.1 once the vendor publishes a patched release.
- Restrict Contributor and Author role assignments to trusted users only, and review existing accounts for anomalies.
- Scan existing posts and pages for the kwm-petfinder shortcode and remove any attribute values that contain HTML or script content.
Patch Information
The vendor committed a fix referenced in WordPress Changeset 3396792. Administrators should apply the corresponding plugin release through the WordPress dashboard or by manually replacing plugin files. Verify the installed version after the update.
Workarounds
- Deactivate the Pet-Manager – Petfinder plugin until a fixed release is installed and verified.
- Deploy a WAF ruleset that blocks shortcode attribute values containing <, >, ", or javascript: when submitted by non-administrator roles.
- Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of stored XSS payloads.
# Disable the vulnerable plugin via WP-CLI until a patched release is applied
wp plugin deactivate tier-management-petfinder
# Search post content for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%kwm-petfinder%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
