CVE-2025-6012: Auto Attachments WordPress Plugin XSS Vulnerability

CVE-2025-6012 Overview

CVE-2025-6012 is a Stored Cross-Site Scripting (XSS) vulnerability in the Auto Attachments plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.8.5. It stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions can inject arbitrary JavaScript that executes when users access affected pages. The issue is scoped to WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated administrators on multi-site WordPress instances can persistently inject scripts that execute in the browsers of other users viewing injected pages.

Affected Products

Auto Attachments plugin for WordPress, versions ≤ 1.8.5
WordPress multi-site installations running the plugin
WordPress single-site installations where unfiltered_html has been disabled

Discovery Timeline

2025-06-13 - CVE-2025-6012 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6012

Vulnerability Analysis

The Auto Attachments plugin exposes administrative settings that accept user-supplied input without sufficient sanitization. When these settings are rendered back into WordPress pages, the plugin fails to properly escape output, allowing embedded HTML and JavaScript to execute in the context of the site. Because the payload is stored server-side, every visitor to an affected page triggers the script, making this a Stored XSS class issue rather than a reflected one. The EPSS score of the vulnerability suggests limited near-term exploitation activity, but the persistence and scope-change nature of the bug warrants remediation.

Root Cause

The root cause is missing input sanitization on values submitted through the plugin's admin settings form combined with missing output escaping when those values are rendered into page HTML. WordPress provides sanitization helpers such as sanitize_text_field() and escaping helpers such as esc_html() and esc_attr(), but the plugin does not apply them consistently to settings values. Under normal single-site WordPress configurations, administrators possess the unfiltered_html capability, so injected markup is expected behavior. On multi-site installs and hardened single-site installs, however, that capability is removed, which is why this vector rises to a reportable vulnerability in those environments.

Attack Vector

An attacker who has already obtained administrator-level credentials on the affected WordPress site navigates to the Auto Attachments plugin settings and injects a JavaScript payload into a vulnerable input field. The payload is persisted in the WordPress database. When any subsequent user views a page rendering that setting, the browser executes the attacker-controlled script in the site's origin. This can be used to hijack sessions of other administrators, pivot privileges within the WordPress instance, or deliver secondary payloads to site visitors. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for further technical detail.

Detection Methods for CVE-2025-6012

Indicators of Compromise

Unexpected <script>, onerror, or onload markup persisted in Auto Attachments plugin option values within the wp_options table.
Outbound requests from user browsers to unfamiliar domains immediately after loading pages that render plugin settings.
Unauthorized changes to administrator accounts or new admin user creation following a settings edit event.

Detection Strategies

Audit the wp_options table for entries owned by the Auto Attachments plugin containing HTML tags or JavaScript event handlers.
Correlate WordPress admin activity logs with settings modification events on the plugin to identify anomalous edits.
Deploy a Web Application Firewall (WAF) rule to inspect POST requests to wp-admin/options.php for script content bound to the plugin's option keys.

Monitoring Recommendations

Enable WordPress audit logging to capture administrator setting changes and file modifications.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that render plugin output.
Alert on creation or modification of privileged WordPress accounts, particularly on multi-site installations.

How to Mitigate CVE-2025-6012

Immediate Actions Required

Update the Auto Attachments plugin to a version newer than 1.8.5 once the vendor releases a patched build.
Review and remove any suspicious HTML or JavaScript content persisted in plugin option values.
Restrict administrator access on multi-site installations using the principle of least privilege and enforce multi-factor authentication for all admins.

Patch Information

At the time of publication, no fixed version has been formally recorded in the enriched CVE data. Consult the WordPress Plugin Source Code repository and the Wordfence Vulnerability Analysis for the latest fix status. If no patched release is available, remove or deactivate the plugin.

Workarounds

Deactivate and remove the Auto Attachments plugin until a patched version is confirmed.
Deploy a WAF rule to block script tags and event-handler attributes in POST requests targeting the plugin's admin settings endpoints.
Enforce a strict Content Security Policy that disallows inline script execution on WordPress admin and public pages.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate auto-attachments
wp plugin delete auto-attachments