Stored Cross-Site Scripting Vulnerability in Simple Post Listing Plugin for WordPress

CVE-2025-12650

What is CVE-2025-12650?

The Simple Post Listing plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'class_name' parameter in the postlist shortcode. This issue stems from inadequate input sanitization and output escaping of user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject malicious web scripts into the pages. These scripts execute upon user interaction with the compromised pages, potentially leading to serious security implications.

References