Stored Cross-Site Scripting Vulnerability in Free Quotation Plugin for WordPress

CVE-2025-12393

What is CVE-2025-12393?

The Free Quotation plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in its admin settings. This vulnerability allows authenticated users with administrator permissions to inject arbitrary scripts, which could execute whenever a user accesses the affected page. The issue primarily impacts multi-site installations and those where unfiltered_html has been disabled, emphasizing the need for developers and site administrators to secure their WordPress environments.

References