Reflected Cross-Site Scripting in Tainacan Plugin for WordPress
CVE-2025-12746

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Tainacan
Vendor
CVE Published:
21 November 2025

What is CVE-2025-12746?

The Tainacan plugin for WordPress suffers from a Reflected Cross-Site Scripting vulnerability through the 'search' parameter. This issue arises from a lack of sufficient input sanitization and output escaping in all versions up to 1.0.0. Attackers can exploit this flaw to inject arbitrary scripts into web pages. If a victim is deceived into clicking a malicious link, the scripts will execute in their browser, potentially leading to unauthorized access and data compromise.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tainacan * <= 1.0.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://github.com/tainacan/tainacan/blob/2491612ee9d5b14...
https://plugins.trac.wordpress.org/changeset/3395909/tain...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peb
JSON
.