CVE-2025-12064 describes a reflected cross-site scripting vulnerability in the WP2Social Auto Publish plugin for WordPress, affecting all versions up to and including 2.4.7. The issue arises from improper neutralization of input during web page generation, specifically via PostMessage, allowing unauthenticated attackers to inject and execute arbitrary web scripts by tricking users into clicking malicious links. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or vendor advisory is provided in the data, and no known exploits have been reported.

Successful exploitation enables an unauthenticated attacker to execute arbitrary scripts in the context of a user's browser session when the user interacts with a crafted link. This can lead to limited confidentiality and integrity impacts, such as theft of user data or manipulation of content. There is no reported impact on system availability. The vulnerability requires user interaction and affects the security scope beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the WP2Social Auto Publish plugin and consider disabling or removing the plugin if possible. Monitor official f1logic or WordPress plugin repositories for updates addressing this vulnerability.