CVE-2025-12019 is a stored Cross-Site Scripting vulnerability in the WordPress Featured Image plugin by mervinpraison. It affects all versions up to and including 2.1. The flaw exists because image metadata is not properly sanitized or escaped before being rendered on web pages. Exploitation requires authenticated users with administrator-level permissions or higher, and it only affects multi-site WordPress installations or those where the unfiltered_html capability is disabled. The vulnerability allows injection of arbitrary web scripts that execute in the context of users viewing the compromised pages.

An authenticated attacker with administrator privileges can inject malicious scripts into pages via image metadata. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, unauthorized actions, or other client-side impacts. The vulnerability does not affect single-site installations or sites with unfiltered_html enabled. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider enabling unfiltered_html if feasible, as the vulnerability only affects sites where it is disabled. Monitor official channels for updates or patches from the plugin vendor.