Reflected Cross-Site Scripting in Tainacan Plugin for WordPress

CVE-2025-12746

What is CVE-2025-12746?

The Tainacan plugin for WordPress suffers from a Reflected Cross-Site Scripting vulnerability through the 'search' parameter. This issue arises from a lack of sufficient input sanitization and output escaping in all versions up to 1.0.0. Attackers can exploit this flaw to inject arbitrary scripts into web pages. If a victim is deceived into clicking a malicious link, the scripts will execute in their browser, potentially leading to unauthorized access and data compromise.

References