Stored Cross-Site Scripting in YouTube Subscribe Plugin for WordPress

CVE-2025-12025

What is CVE-2025-12025?

The YouTube Subscribe plugin for WordPress allows authenticated attackers with administrator-level permissions to exploit stored cross-site scripting vulnerabilities. This is due to insufficient input sanitization and output escaping within the plugin's admin settings. Attackers can inject arbitrary web scripts that execute when users access affected pages. This issue is particularly pertinent for multi-site WordPress installations or environments where unfiltered_html has been disabled, posing a significant risk to website integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References