CVE-2025-0512 is a stored cross-site scripting vulnerability in the gorbo Structured Content (JSON-LD) #wpsc WordPress plugin. It specifically affects the sc_fs_local_business shortcode, where user input is not properly sanitized or escaped before being included in web pages. This allows authenticated users with contributor or higher privileges to inject malicious scripts that execute in the context of any user viewing the compromised page. The vulnerability is present in all versions up to 6.4.5. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch information currently provided.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to unauthorized actions or data disclosure within the context of the affected site. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Structured Content (JSON-LD) #wpsc plugin if possible to mitigate risk.