CVE-2025-12717: WordPress List Attachments XSS Vulnerability

CVE-2025-12717 Overview

CVE-2025-12717 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the List Attachments Shortcode plugin for WordPress. The flaw affects all versions up to and including 0.4.1a. It resides in the before_list parameter of the [list-attachments] shortcode, where user-supplied input is not properly sanitized or escaped before being rendered in page output.

Authenticated attackers with Author-level access or higher can inject arbitrary web scripts into pages. The scripts execute in the browsers of any users who view the affected pages, enabling session theft, redirection, or actions performed under the victim's session.

Critical Impact
Authenticated authors can persist JavaScript into published WordPress pages, exposing site visitors and administrators to script execution in the site's origin.

Affected Products

List Attachments Shortcode plugin for WordPress
All versions up to and including 0.4.1a
WordPress installations exposing Author-level or higher accounts

Discovery Timeline

2025-12-06 - CVE-2025-12717 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12717

Vulnerability Analysis

The vulnerability is a stored XSS issue triggered through a WordPress shortcode attribute. The plugin registers the [list-attachments] shortcode, which accepts a before_list parameter intended to render HTML content preceding the attachment list. The plugin uses this parameter value directly in output without applying escaping functions such as esc_attr(), esc_html(), or wp_kses().

Any authenticated user who can create or edit posts and pages (Author role or higher) can embed the shortcode with a malicious before_list value. The injected payload is stored in the post content and served to every visitor of the page. Because the payload executes in the site's origin, it can access cookies not marked HttpOnly, perform actions through the WordPress REST API, or pivot to administrator sessions.

Root Cause

The root cause is missing input sanitization and output escaping in the shortcode handler. Shortcode attributes reach the render function and are concatenated into page output without validation. WordPress does not automatically escape shortcode attribute values, placing the responsibility on the plugin author. Reference implementation is available in the WordPress Plugin Code Snippet.

Attack Vector

Exploitation requires an authenticated account with the Author capability or higher. The attacker creates or edits a page and inserts the [list-attachments] shortcode with a crafted before_list attribute containing an HTML or JavaScript payload. Once published, the payload executes whenever the page is rendered in a visitor's browser. No user interaction beyond viewing the page is required. See the Wordfence Vulnerability Analysis for additional context.

Detection Methods for CVE-2025-12717

Indicators of Compromise

Post or page content containing [list-attachments] shortcodes with before_list attributes holding <script>, onerror, onload, or javascript: payloads.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that use the plugin.
New or modified posts authored by low-privilege Author accounts that contain HTML markup in shortcode parameters.

Detection Strategies

Query the wp_posts table for post_content matching %[list-attachments%before_list=%<% to surface suspicious shortcode usage.
Review WordPress audit logs for post edits performed by Author-level accounts that introduce shortcode markup.
Inspect served HTML for inline script tags rendered outside of expected theme templates.

Monitoring Recommendations

Enable file integrity and content monitoring on the wp_posts table and plugin directory.
Alert on the creation of administrator accounts or role changes following visits to pages that use the vulnerable plugin.
Monitor Content Security Policy (CSP) violation reports for blocked inline script executions on public pages.

How to Mitigate CVE-2025-12717

Immediate Actions Required

Update the List Attachments Shortcode plugin to a version above 0.4.1a that addresses the sanitization gap, or deactivate the plugin until a fix is confirmed.
Audit existing posts for [list-attachments] shortcodes containing suspicious before_list attribute values and remove or sanitize them.
Rotate credentials and session tokens for administrator accounts that may have viewed injected pages.

Patch Information

The NVD entry identifies all versions up to and including 0.4.1a as vulnerable. Site administrators should install the latest available release of the List Attachments Shortcode plugin from the WordPress plugin repository and verify the version through the plugin manager after upgrade. Reference the Wordfence Vulnerability Analysis for advisory details.

Workarounds

Restrict the Author role assignment to trusted users and require multi-factor authentication for all content-editing accounts.
Deploy a web application firewall (WAF) rule that blocks shortcode attributes containing HTML tags or javascript: schemes in POST requests to wp-admin/post.php.
Enforce a strict Content Security Policy that disallows inline scripts on front-end pages to reduce the impact of stored XSS payloads.
Remove the [list-attachments] shortcode from published content until the plugin is updated.

bash

# Configuration example: search the WordPress database for suspicious shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[list-attachments%before_list=%<%' \
  AND post_status IN ('publish','draft','pending');"