CVE-2025-12019

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.mdExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L26URL Repurposed
• https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L35URL Repurposed
• https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L65URL Repurposed
• https://plugins.trac.wordpress.org/changeset/3392100/
• https://wordpress.org/plugins/featured-image/Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=cveThird Party Advisory
• https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.mdExploit, Third Party Advisory

Published

Nov 11, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12012A denial-of-service issue exists in 5380/5480/5580 controlle…9.2
• CVE-2025-12014The NGINX Cache Optimizer plugin for WordPress is vulnerable…4.3
• CVE-2025-12015The Convert WebP & AVIF | Quicq | Best image optimizer and c…4.3
• CVE-2025-12016The qnotsquiz plugin for WordPress is vulnerable to Stored C…4.4
• CVE-2025-12017The VNPAY Payment gateway plugin for WordPress is vulnerable…6.1
• CVE-2025-12018The MembershipWorks – Membership, Events & Directory plugin …4.4
• CVE-2025-1202A vulnerability classified as critical has been found in Sou…6.5
• CVE-2025-12020The Double the Donation – A workplace giving tool to help yo…4.9
• CVE-2025-12021The WP-OAuth plugin for WordPress is vulnerable to Reflected…6.1
• CVE-2025-12022The ELEX WordPress HelpDesk & Customer Ticketing System plug…4.3
• CVE-2025-12023The ELEX WordPress HelpDesk & Customer Ticketing System plug…4.3
• CVE-2025-12024Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…