Stored Cross-Site Scripting Vulnerability in Flickr Show Plugin for WordPress

CVE-2025-12672

What is CVE-2025-12672?

The Flickr Show plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'div_height' parameter in the 'flickrshow' shortcode. This issue arises from inadequate input sanitization and output escaping, enabling attackers with Contributor-level access or above to inject malicious scripts. These scripts will execute when users visit affected pages, posing a significant risk to site security. Users of affected versions should take immediate action to mitigate this risk.

References