CVE-2025-12746: Tainacan WordPress Plugin XSS Vulnerability

CVE-2025-12746 Overview

CVE-2025-12746 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Tainacan plugin for WordPress. The flaw affects all versions up to and including 1.0.0. It resides in the search parameter handling within the taxonomy search field, where user-supplied input is echoed back into HTML output without sanitization or escaping. Unauthenticated attackers can craft malicious links that inject arbitrary JavaScript into the rendered page. Successful exploitation requires user interaction, typically clicking a crafted URL. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user who clicks a crafted link, enabling session theft, credential harvesting, and administrative account takeover on affected WordPress sites.

Affected Products

Tainacan plugin for WordPress — all versions up to and including 1.0.0
WordPress sites running vulnerable Tainacan installations exposing the taxonomy search feature
Deployments using src/classes/theme-helper/template-tags.php prior to commit 8468fb4

Discovery Timeline

2025-11-21 - CVE-2025-12746 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12746

Vulnerability Analysis

The vulnerability exists in the taxonomy search template rendering logic of the Tainacan plugin. The search query parameter is retrieved from $current_args['search'] and directly echoed into an HTML value attribute without being passed through WordPress escaping functions. Because the reflected value lands inside an attribute context, an attacker can break out of the attribute using a double quote and inject event handler attributes or script tags. Exploitation requires a victim to visit an attacker-crafted URL, so it fits the classic reflected XSS model with scope change to the browser origin.

Root Cause

The root cause is missing output escaping in src/classes/theme-helper/template-tags.php at the search input rendering line. The plugin used <?php echo $current_args['search']; ?> inside an HTML value="..." attribute. Without esc_attr(), any characters supplied via the search GET parameter are rendered verbatim, breaking the attribute quoting and enabling script injection.

Attack Vector

An attacker constructs a URL pointing to a page that renders the Tainacan taxonomy search block, supplying a malicious search parameter payload. The attacker delivers the URL through phishing, social media, or a compromised site. When the victim clicks the link, the injected payload executes in the victim's browser under the site's origin, allowing cookie theft, session hijacking, or arbitrary DOM manipulation.

php

// Vulnerable code (removed) and fix (added)
// Source: https://github.com/tainacan/tainacan/commit/8468fb4ec76c709d5ae2852d1fc64986b1dc73cf

            id="tainacan-taxonomy-search-field--input"
            class="wp-block-search__input wp-block-search__input"
            name="search"
-           value="<?php echo $current_args['search']; ?>"
+           value="<?php echo esc_attr( $current_args['search'] ); ?>"
            placeholder="<?php echo __( 'Search by a term name', 'tainacan'); ?>">

The patch wraps the reflected value with esc_attr(), which encodes characters such as ", ', <, >, and & so they cannot terminate the attribute or introduce new markup. See the GitHub Commit Reference and WordPress Plugin Changeset for the full diff.

Detection Methods for CVE-2025-12746

Indicators of Compromise

HTTP GET requests to Tainacan-enabled pages with search parameter values containing <script, onerror=, onload=, or attribute-breaking sequences such as "><
Referrer logs showing external inbound traffic to taxonomy search URLs with unusually long or URL-encoded search payloads
Web application firewall (WAF) alerts flagging reflected XSS signatures against Tainacan endpoints
Browser console errors or content security policy (CSP) violations reported on pages that render the taxonomy search block

Detection Strategies

Inspect Tainacan installations for versions 1.0.0 or earlier and confirm template-tags.php matches the pre-patch line at commit 2491612
Deploy WAF rules that decode and inspect the search query parameter for HTML metacharacters on Tainacan pages
Enable HTTP access logging with full query strings and search for repeated probing of the search parameter from single IPs
Use static analysis to flag PHP files where superglobals or arg arrays flow into echo inside attribute contexts without esc_attr()

Monitoring Recommendations

Alert on any 200-response requests to Tainacan search endpoints that contain URL-encoded <, >, or javascript: tokens in the search parameter
Correlate WordPress admin session anomalies with prior XSS-shaped requests to detect potential account takeover
Monitor CSP violation reports for inline script executions originating from Tainacan template output

How to Mitigate CVE-2025-12746

Immediate Actions Required

Update the Tainacan plugin to a version later than 1.0.0 that includes commit 8468fb4ec76c709d5ae2852d1fc64986b1dc73cf
Audit administrator and editor sessions for suspicious activity following the patch window
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected
Enable a Content Security Policy that restricts inline scripts on public-facing WordPress pages

Patch Information

The upstream fix is committed to the Tainacan repository and released via the WordPress plugin directory. The patch adds esc_attr() around the reflected search value in src/classes/theme-helper/template-tags.php. Refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Report for version guidance.

Workarounds

Temporarily disable the Tainacan plugin on production sites until the patched version is deployed
Deploy a WAF rule that blocks requests containing HTML metacharacters in the search parameter on Tainacan endpoints
Apply a strict Content Security Policy header disallowing inline scripts and untrusted event handlers

bash

# Example WAF rule concept for a reverse proxy (ModSecurity syntax)
SecRule ARGS:search "@rx (?i)(<script|onerror=|onload=|javascript:|\"><)" \
    "id:1012746,phase:2,deny,status:403,\
     msg:'CVE-2025-12746 Tainacan reflected XSS attempt',\
     tag:'CWE-79'"