CVE-2025-12885

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-128867.2The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laboraCVE-2025-128875.4The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the pluCVE-2025-128887.5Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPUCVE-2025-128895.4With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateReCVE-2025-12894.8The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege usersCVE-2025-128906.5Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triCVE-2025-128915.3The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_showCVE-2025-128925.3The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivateCVE-2025-128935.4Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documenCVE-2025-128945.3The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in allCVE-2025-128955.3The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capabCVE-2025-128964.4Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authori