CVE-2025-12629

HighCVSS 7.1/10Last modified Oct 8, 2026

Description

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affected software

VendorProductVersions
UnknownBroken Link Manager<= 0.6.5

References

Timeline

Published
Nov 24, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-126304.9The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX requCVE-2025-126314.4The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, andCVE-2025-126325.5The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1CVE-2025-126337.5The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missingCVE-2025-126344.3The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checkCVE-2025-126355.4IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-siteCVE-2025-126366.5The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The CVE-2025-126378.8The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the procesCVE-2025-126388.0Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The CVE-2025-126394.3The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versionCVE-2025-12646.5The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via tCVE-2025-126404.3The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthori
CVE-2025-12629: High severity, CVSS 7.1 | Vulnix