CVE-2025-12651

The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/live-photos/tags/0.1/core/class-livephotos-shortcodes.php#L42
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fba3090f-2cc2-4e40-8080-ae83ba321a67?source=cve

Published

Nov 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12645The Inline frame – Iframe plugin for WordPress is vulnerable…6.4
• CVE-2025-12646The Community Events plugin for WordPress is vulnerable to S…7.5
• CVE-2025-12648The WP-Members Membership Plugin for WordPress is vulnerable…5.3
• CVE-2025-12649The SortTable Post plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-1265An OS command injection vulnerability exists in Vinci Protoc…9.9
• CVE-2025-12650The Simple post listing plugin for WordPress is vulnerable t…6.4
• CVE-2025-12652The Ungapped Widgets plugin for WordPress is vulnerable to S…6.4
• CVE-2025-12653GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-12654The Migration, Backup, Staging – WPvivid Backup & Migration …2.7
• CVE-2025-12655The Hippoo Mobile App for WooCommerce plugin for WordPress i…5.3
• CVE-2025-12656The Migration, Backup, Staging – WPvivid Backup & Migration …3.8
• CVE-2025-12657The KMIP response parser built into mongo binaries is overly…5.5