CVE-2025-12885: 
WordPress vulnerability analysis and mitigation

CVE-2025-12885 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files" WordPress plugin, affecting all versions up to and including 2.7.10. The flaw exists in the sanitize_pdf_src function, where a regex bypass allows insufficient input sanitization and output escaping. It was disclosed on December 17–18, 2025, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The sanitize_pdf_src function in the plugin uses a regular expression to validate or sanitize document source URLs, but this regex can be bypassed by a crafted input, allowing arbitrary JavaScript to be stored and later rendered in page output without proper escaping. An authenticated attacker with at minimum Contributor-level access can embed a malicious script via the plugin's document embedding shortcode or block, which then executes in the browser of any user who visits the affected page. The fix was committed to the WordPress plugin repository in changeset 3406443 (WordPress Trac, Wordfence).

Successful exploitation allows an authenticated Contributor (or higher-privileged) attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or delivery of further malware payloads to site visitors. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to affect end users' browsers, compromising both site integrity and visitor confidentiality (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running the Embed Any Document plugin version ≤ 2.7.10.
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create or edit a post or page where the Embed Any Document shortcode or block can be inserted.
3. Craft Malicious Payload: Construct a document source URL or parameter that bypasses the sanitize_pdf_src regex validation, embedding a JavaScript payload (e.g., javascript:/*<script>alert(document.cookie)</script>*/ or a crafted URL that passes the regex but contains executable script).
4. Inject and Publish: Insert the crafted shortcode or block with the malicious payload into the post/page content and publish or save it.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from Contributor-level accounts containing unusual URL-encoded or obfuscated strings in document source parameters.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags, JavaScript URIs, or encoded payloads within Embed Any Document shortcodes (e.g., [embeddoc url="..."]).
• Network: Outbound connections from visitor browsers to unknown external domains shortly after loading pages containing the Embed Any Document shortcode, potentially indicating script-based data exfiltration.
• Logs: WordPress audit logs (if enabled) recording Contributor-level users editing or publishing posts with embed shortcodes containing non-standard URL schemes.

Site administrators should update the Embed Any Document plugin to version 2.7.11 or later, which contains the fix committed in changeset 3406443 to the WordPress plugin repository. No configuration-based workaround is documented; the primary remediation is upgrading the plugin. As an interim measure, administrators may restrict Contributor-level user registration or disable the plugin until the update can be applied. Wordfence users with the premium firewall may have additional protection via virtual patching (WordPress Trac, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, and Sucuri referenced it in their December 2025 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). Community reaction has been limited, consistent with the medium severity rating and the requirement for authenticated access. No significant vendor statements beyond the patch release or notable researcher commentary have been identified.