CVE-2025-12499

HighCVSS 7.2/10Last modified Oct 15, 2026

Description

The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
widgetpack	Rich Showcase for Google Reviews	<= 6.8

References

Timeline

Published: Dec 6, 2025
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-12506.5An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that CVE-2025-125005.3The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in a CVE-2025-125017.5Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks (DoS CVE-2025-125026.8The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing hig CVE-2025-125036.5EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject a CVE-2025-125049.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software UNIS allows SQL Inject CVE-2025-125055.4The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin CVE-2025-125064.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 t CVE-2025-125078.8The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS serv CVE-2025-125088.4When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of a CVE-2025-125098.4On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with ad CVE-2025-125107.2The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.