Stored Cross-Site Scripting Vulnerability in FitVids for WordPress Plugin

CVE-2025-12124

What is CVE-2025-12124?

The FitVids for WordPress plugin is susceptible to Stored Cross-Site Scripting (XSS) through its admin settings. This vulnerability arises from inadequate input validation and output sanitization, allowing authenticated attackers with administrative access to inject malicious scripts into web pages. This can lead to the execution of arbitrary code when a user accesses the compromised pages. It is particularly concerning for multi-site environments and those with unfiltered HTML disabled, where the risk of exploitation is heightened.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References