CVE-2025-12124

The FitVids for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://wordpress.org/plugins/fitvids-for-wordpress/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/063a245d-bd9e-49ac-bdf0-549a25eba9fe?source=cve

Published

Dec 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12119A mongoc_bulk_operation_t may read invalid memory if large o…3.3
• CVE-2025-1212An information disclosure vulnerability in GitLab CE/EE affe…7.5
• CVE-2025-12120Lite XL versions 2.1.8 and prior automatically execute the .…7.3
• CVE-2025-12121Lite XL versions 2.1.8 and prior contain a vulnerability in …7.3
• CVE-2025-12122The Popup Box – Easily Create WordPress Popups plugin for Wo…6.4
• CVE-2025-12123The Customer Reviews Collector for WooCommerce plugin for Wo…6.1
• CVE-2025-12125The HTML Forms – Simple WordPress Forms Plugin plugin for Wo…4.4
• CVE-2025-12126The The Total Book Project plugin for WordPress is vulnerabl…5.4
• CVE-2025-12127Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-12128The Hide Categories Or Products On Shop Page plugin for Word…4.3
• CVE-2025-12129The CubeWP – All-in-One Dynamic Content Framework plugin for…5.3
• CVE-2025-1213A vulnerability was found in pihome-shc PiHome 1.77. It has …5.4