CVE-2025-12670

The wp-twitpic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'twitpic' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-12670

CVE-2025-12670 affects the WordPress plugin wp-twitpic (shortcode parameter handling). The vulnerability is a Stored Cross-Site Scripting (XSS) via multiple parameters of the twitpic shortcode in all versions up to and including 1.0, caused by insufficient input sanitization and output escaping. ...