Overview
A stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-12710, has been discovered in the Pet-Manager β Petfinder plugin for WordPress. This vulnerability affects all versions up to and including 3.6.1. Authenticated attackers with Contributor-level access or higher can exploit this flaw to inject malicious JavaScript code into pages. This code will then execute whenever other users access those compromised pages.
Technical Details
The vulnerability stems from insufficient input sanitization and output escaping within the kwm-petfinder shortcode. User-supplied attributes to this shortcode are not properly validated, allowing attackers to inject arbitrary web scripts. The vulnerable code is specifically located within the kwm-petfinder.php file, which handles the shortcode functionality.
The injection points are related to how the shortcode attributes are processed and displayed within the plugin’s output.
CVSS Analysis
The vulnerability has been assigned a CVSS score of 6.4 (MEDIUM).
- CVSS Vector: (This would be populated with the actual vector string if available)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (Contributor or higher role)
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Possible Impact
Successful exploitation of this XSS vulnerability can lead to:
- Account Takeover: An attacker could potentially steal administrator cookies or redirect users to phishing sites, leading to account compromise.
- Malware Distribution: Injecting malicious scripts could allow attackers to distribute malware to unsuspecting website visitors.
- Website Defacement: Attackers can modify the appearance or content of the affected pages, damaging the website’s reputation.
- Data Theft: Sensitive information displayed on the affected pages could be accessed by the attacker.
Mitigation or Patch Steps
The most important step is to update the Pet-Manager β Petfinder plugin to the latest version. If an update is not yet available, consider temporarily disabling the plugin until a patched version is released.
If you cannot immediately update or disable the plugin, consider implementing a web application firewall (WAF) with rules to block XSS attacks targeting the kwm-petfinder shortcode. Additionally, closely monitor user activity for any suspicious behavior, such as attempts to inject unusual code into pages.
Review existing pages where the kwm-petfinder shortcode is used, looking for any unexpected or unusual content. If found, remove or modify the shortcode immediately.
References
kwm-petfinder.php (Line 133)
kwm-petfinder.php (Line 163)
kwm-petfinder.php (Line 164)
Plugin Changeset
Wordfence Threat Intelligence Report
