{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12672", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-03T21:43:16.188Z", "datePublished": "2025-11-11T03:30:40.036Z", "dateUpdated": "2026-04-08T16:55:21.702Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:21.702Z"}, "affected": [{"vendor": "nuvuscripts", "product": "Flickr Show", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Flickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b792892-25dc-4df0-883d-afd0b47292e0?source=cve"}, {"url": "https://wordpress.org/plugins/wp-flickrshow/"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-flickrshow/tags/1.5/flickrshow.php#L230"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2025-11-10T15:26:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T15:58:59.548258Z", "id": "CVE-2025-12672", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:06:50.236Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T15:58:59.548258Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T15:59:02.087Z"}}], "cna": {"title": "Flickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "nuvuscripts", "product": "Flickr Show", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:26:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b792892-25dc-4df0-883d-afd0b47292e0?source=cve"}, {"url": "https://wordpress.org/plugins/wp-flickrshow/"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-flickrshow/tags/1.5/flickrshow.php#L230"}], "descriptions": [{"lang": "en", "value": "The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:21.702Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12672", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:55:21.702Z", "dateReserved": "2025-11-03T21:43:16.188Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:40.036Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-12672", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-11T04:15:49.753", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-flickrshow/tags/1.5/flickrshow.php#L230"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wp-flickrshow/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b792892-25dc-4df0-883d-afd0b47292e0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:30:46.315909+00:00", "value": {"mitigation_remediation": ["Upgrade the Flickr Show plugin to the latest available version that removes the stored XSS vulnerability.", "Restrict or remove the 'div_height' shortcode attribute for users who do not need it, or ensure the plugin sanitizes the value to numeric-only before storing it.", "Review contributor permissions and limit the ability of contributors to add or modify posts containing the Flickr Show shortcode."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed Nuvuscripts' Flickr Show plugin version 1.5 or earlier are affected. Any site using this plugin, regardless of theme or other plugins, will be vulnerable if it exposes the shorter shortcode with a contributor who can edit or create posts.", "description_and_impact": "The Flickr Show plugin for WordPress contains a stored cross\u2011site scripting flaw that can be triggered through the 'div_height' parameter of the 'flickrshow' shortcode. When an authenticated contributor or higher level user specifies a malicious value, the input is saved without proper sanitization or escaping, leading to arbitrary JavaScript execution whenever a page containing the shortcode is viewed. This can enable attackers to steal session cookies, deface content, or deflect traffic to malicious sites.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity; however, the EPSS score is below 1\u2009% and the vulnerability is not listed in the CISA KEV catalog, which suggests a low likelihood of widespread exploitation at present. The attack requires authenticated access with at least contributor privileges, but once compromised the stored script persists and will execute for all users who view the impacted page."}}}}, "created": "2025-11-12T12:47:51.164994+00:00", "updated": "2026-04-21T18:45:06.070280+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}