CVE-2025-12663: 
WordPress vulnerability analysis and mitigation

The Jeba Cute forkit plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-12663) discovered on November 11, 2025. The vulnerability affects all versions up to and including 1.0, and is present in the 'text' parameter of the 'jeba_forkit' shortcode. The plugin has been temporarily closed pending a full security review (WordPress Plugin, AttackerKB).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the 'text' parameter of the 'jeba_forkit' shortcode. This allows for the injection of arbitrary web scripts that execute when users access affected pages (AttackerKB).

When successfully exploited, the vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute whenever any user, including administrators, accesses the compromised pages (AttackerKB).

The plugin has been temporarily closed and is no longer available for download as of November 7, 2025, pending a full security review. Site administrators using this plugin should consider disabling it until a patched version is released (WordPress Plugin).