Stored Cross-Site Scripting Vulnerability in Nari Accountant Plugin for WordPress

CVE-2025-12371

What is CVE-2025-12371?

The Nari Accountant plugin for WordPress is susceptible to a stored Cross-Site Scripting (XSS) vulnerability due to inadequate input validation and output escaping. This issue impacts all versions up to and including 1.0.12 and is particularly concerning for multi-site setups and configurations where unfiltered HTML is disabled. Authenticated attackers with editor-level privileges can exploit this vulnerability to inject malicious scripts into pages that execute when accessed by unsuspecting users.

References