PT-2025-46284 · WordPress · Live Photos On Wordpress

Zakaria · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12651

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Live Photos on WordPress plugin versions prior to 0.1

Description The Live Photos on WordPress plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping on user-supplied attributes. Specifically, the 'video src', 'img src', and 'class' parameters within the livephotos photo shortcode are vulnerable. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update the Live Photos on WordPress plugin to a version newer than 0.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12651

Affected Products

Live Photos On Wordpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12651 · Security Note
• https://t.me/CVEtracker/36987 · Telegram Post
• https://plugins.trac.wordpress.org/browser/live-photos/tags/0.1/core/class-livephotos-shortcodes.php#L42 · Note
• https://twitter.com/CVEnew/status/1988095292671938877 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988232108616069323 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fba3090f-2cc2-4e40-8080-ae83ba321a67?source=cve · Note