Stored Cross-Site Scripting in Share to Google Classroom Plugin for WordPress

CVE-2025-12711

What is CVE-2025-12711?

The Share to Google Classroom plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS). This vulnerability arises from inadequate input sanitization and output escaping in the 'share_to_google' shortcode. Authenticated users with Contributor-level access or higher can exploit this flaw to inject arbitrary web scripts. The scripts will then execute on the victim's browser whenever they access the affected page, potentially leading to unauthorized actions or data exposure. Users are urged to update their plugins immediately to mitigate these risks.

References