Stored Cross-Site Scripting Vulnerability in Live Photos Plugin for WordPress

CVE-2025-12651

What is CVE-2025-12651?

The Live Photos plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization and escaping of user inputs in the livephotos_photo shortcode. This vulnerability allows attackers with contributor-level access to inject malicious scripts through the 'video_src', 'img_src', and 'class' parameters. When users access the compromised pages, these scripts are executed, potentially leading to unauthorized actions or data exposure.

References