CVE-2025-12393: 
WordPress vulnerability analysis and mitigation

The Free Quotation plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-12393) affecting all versions up to and including 3.1.6. The vulnerability was discovered and disclosed on November 4, 2025. This security issue specifically impacts WordPress installations with the Free Quotation plugin installed, particularly affecting multi-site installations and installations where unfiltered_html has been disabled (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the admin settings of the Free Quotation plugin. It has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD, Wordfence).

The vulnerability allows authenticated attackers with administrator-level permissions or above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized data access or manipulation (NVD).

The plugin has been temporarily closed as of October 31, 2025, pending a full security review (WordPress). Users are advised to disable and remove the plugin until a patched version becomes available.