Stored Cross-Site Scripting in Canadian Nutrition Facts Label Plugin for WordPress

CVE-2025-12715

What is CVE-2025-12715?

The Canadian Nutrition Facts Label plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'percentage' field of the Nutrition Label custom post type. This vulnerability allows authenticated users with Contributor-level access or higher to inject malicious web scripts into pages. When users visit these compromised pages, the injected scripts execute, potentially leading to unauthorized actions and data exposure.

References