Stored Cross-Site Scripting Vulnerability in WP Carticon Plugin for WordPress

CVE-2025-12065

What is CVE-2025-12065?

The WP Carticon plugin for WordPress is susceptible to Stored Cross-Site Scripting, resulting from inadequate input sanitization and output escaping in the 'carticon_js_script' parameter. This vulnerability primarily affects multi-site installations where unfiltered HTML is disabled, allowing authenticated users with administrator-level access to inject and execute arbitrary web scripts on pages viewed by other users. This poses significant risks for websites using the plugin, as malicious scripts could lead to unauthorized data access or manipulation.

References