CVE-2025-12066

Name of the Vulnerable Software and Affected Versions WP Delete Post Copies versions prior to 6.0.3

Description The WP Delete Post Copies plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update WP Delete Post Copies to version 6.0.3 or later.