CVE-2025-12017 is a reflected cross-site scripting vulnerability in the VNPAY Payment gateway WordPress plugin by teyldoan. The flaw exists in all versions up to and including 1.0.0, specifically in the handling of the 'message' parameter, which lacks proper input sanitization and output escaping. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link, potentially compromising user sessions or data. The vulnerability is publicly disclosed with a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website for users who click on malicious links. This can result in limited confidentiality and integrity impacts such as session hijacking or defacement. There is no impact on availability. No known active exploitation has been reported.

No official patch or remediation has been published by the vendor as of the current information. Users of the VNPAY Payment gateway plugin should monitor the vendor's advisory channels for updates. Until a fix is available, administrators should consider disabling or restricting access to the vulnerable plugin or implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the 'message' parameter. Avoiding user interaction with suspicious links can reduce risk.