CVE-2025-12712: WordPress Shouty Plugin XSS Vulnerability

CVE-2025-12712 Overview

The Shouty plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the shouty shortcode. The flaw affects all versions up to and including 0.2.1. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript through unsanitized shortcode attributes. The injected scripts execute in the browser of any visitor who loads the affected page.

The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation. Wordfence published the initial threat intelligence report on this issue.

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that run in the context of every visitor, including administrators, enabling session theft, account takeover, and malicious redirects.

Affected Products

Shouty plugin for WordPress, all versions through 0.2.1
WordPress sites permitting Contributor-level registration or higher
Any WordPress installation where the Shouty plugin is active and the shouty shortcode is rendered

Discovery Timeline

2025-11-27 - CVE-2025-12712 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12712

Vulnerability Analysis

The Shouty plugin registers a shouty shortcode handler that accepts user-supplied attributes. According to the referenced source at shouty.php lines 138-139, the handler concatenates shortcode attribute values directly into HTML output. The plugin does not apply WordPress escaping functions such as esc_attr() or esc_html() before rendering.

Authenticated users with the Contributor role can insert shortcodes into post content. When a post containing a malicious shouty shortcode is viewed, the browser parses and executes the attacker-supplied script. The stored nature of the flaw means the payload persists across sessions until the offending post is removed or sanitized.

Root Cause

The root cause is missing input sanitization and output escaping on shortcode attributes. WordPress plugins are expected to normalize attributes with shortcode_atts() and escape them with context-appropriate functions before echoing HTML. The Shouty plugin performs neither step, allowing raw HTML and JavaScript to reach the DOM.

Attack Vector

An attacker registers or compromises a Contributor account on a target WordPress site. The attacker then creates or edits a post containing a shouty shortcode with a crafted attribute value that embeds an HTML event handler or <script> tag. Once the post is published or previewed by a higher-privileged user, the payload executes with the victim's session context. This can facilitate administrator session theft, forced privilege escalation via WordPress REST API calls, or arbitrary page redirection.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12712

Indicators of Compromise

Post or page content containing [shouty ...] shortcodes with unusual attribute values such as onerror=, onclick=, javascript:, or <script> fragments
Unexpected outbound HTTP requests from browser sessions of administrators after viewing content authored by Contributor accounts
New administrator accounts, plugin installations, or option changes shortly after a Contributor edits a post

Detection Strategies

Query the wp_posts table for post_content matching %[shouty% combined with patterns like %script%, %onerror%, or %onload%
Review WordPress audit logs for shortcode edits performed by non-Editor accounts
Inspect rendered HTML of pages using the shortcode for script tags or event handlers that do not appear in the plugin template

Monitoring Recommendations

Enable a WordPress activity log plugin to record post edits, user role changes, and plugin state changes
Forward web server access logs and WordPress audit events to a centralized logging platform for correlation of Contributor activity with administrator session anomalies
Alert on newly created posts by low-privilege users that contain shortcode attributes with HTML metacharacters

How to Mitigate CVE-2025-12712

Immediate Actions Required

Deactivate the Shouty plugin until a patched version is available
Audit all posts and pages for the shouty shortcode and remove any with suspicious attribute content
Review Contributor and Author accounts for unfamiliar registrations and reset credentials where warranted
Rotate administrator session cookies and force re-authentication for privileged users

Patch Information

No patched version is referenced in the NVD entry at the time of publication. The vulnerability affects all releases up to and including 0.2.1. Monitor the WordPress plugin repository for Shouty and the Wordfence advisory for release announcements.

Workarounds

Uninstall the Shouty plugin and replace shortcode instances with static HTML sanitized by a trusted editor
Restrict the ability to publish content containing shortcodes to Editor or Administrator roles using a capability management plugin
Deploy a Web Application Firewall rule that blocks POST requests containing [shouty combined with HTML event handler tokens
Enforce a Content Security Policy that disallows inline scripts to reduce the impact of any stored XSS payload

bash

# Example WordPress CLI query to locate affected shortcodes
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[shouty%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%onload=%');"