CVE-2025-12065

Name of the Vulnerable Software and Affected Versions WP Carticon versions prior to 1.0.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can inject arbitrary web scripts into pages that execute when a user accesses them. This issue specifically affects multi-site installations and environments where unfiltered html has been disabled. The flaw is triggered via the carticon js script parameter.

Recommendations Update WP Carticon to a version later than 1.0.0. Avoid using the carticon js script parameter until the update is applied.