{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12371", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-27T20:32:16.245Z", "datePublished": "2025-11-04T04:27:21.431Z", "dateUpdated": "2026-04-08T17:19:40.104Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:40.104Z"}, "affected": [{"vendor": "shakhi", "product": "Nari Accountant", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Nari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a5e6b9-4da1-4d95-9fb1-aabb0d21b695?source=cve"}, {"url": "https://wordpress.org/plugins/nari-accountant/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-11-03T15:32:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T15:15:36.075439Z", "id": "CVE-2025-12371", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T15:15:44.559Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T15:15:36.075439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T15:15:40.790Z"}}], "cna": {"title": "Nari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "shakhi", "product": "Nari Accountant", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T15:32:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a5e6b9-4da1-4d95-9fb1-aabb0d21b695?source=cve"}, {"url": "https://wordpress.org/plugins/nari-accountant/"}], "descriptions": [{"lang": "en", "value": "The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:40.104Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12371", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:19:40.104Z", "dateReserved": "2025-10-27T20:32:16.245Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:21.431Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "id": "CVE-2025-12371", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-04T05:16:11.590", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/nari-accountant/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a5e6b9-4da1-4d95-9fb1-aabb0d21b695?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:55:38.445214+00:00", "value": {"mitigation_remediation": ["Upgrade the Nari Accountant plugin to a version newer than 1.0.12", "Restrict editor\u2011level users or modify role capabilities to reduce the pool of users able to modify account settings", "Disable the unfiltered_html capability or enforce strict content filtering to prevent raw script injection"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting that allows authenticated editors to inject scripts that run for all site visitors"}, "threat_synthesis": {"affected_systems": "WordPress installations running the Nari Accountant plugin version 1.0.12 or earlier on a multi\u2011site setup or where the unfiltered_html capability has been disabled. The vulnerability is specific to the Nari Accountant product, which is distributed by shakhi.", "description_and_impact": "The Nari Accountant plugin contains a stored cross\u2011site scripting flaw in its account settings pages caused by insufficient input sanitization and output escaping. The flaw permits authenticated users with editor privileges or higher to inject arbitrary JavaScript that is then rendered for any user who visits the affected page. The injection can lead to session hijacking, defacement or malware delivery within the site\u2019s context. Based on the description, the attack vector requires that the attacker be logged in and possess at least editor rights, but is otherwise straightforward to exploit once those conditions are met.", "risk_and_exploitability": "The CVSS score of 4.4 classifies the vulnerability as moderate, but the EPSS score of less than 1% indicates an extremely low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, reflecting its limited public exploitation potential. Because the exploit requires authenticated editor or higher access, the risk is constricted to sites with many such users or where roles are mis\u2011assigned, yet the impact remains significant for any impacted site."}}}}, "created": "2025-11-04T16:33:06.019556+00:00", "updated": "2026-04-21T02:00:12.306097+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}