CVE-2025-12021 is a reflected cross-site scripting vulnerability in the WP-OAuth plugin for WordPress, affecting all versions up to and including 0.4.1. The issue stems from improper neutralization of input in the 'error_description' parameter, which is not properly sanitized or escaped before being included in web pages. This allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially enabling theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction (clicking a crafted link) and does not grant direct system access or denial of service. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on suspicious links that might exploit this vulnerability. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.