CVE-2025-12066 is a stored cross-site scripting vulnerability in the WP Delete Post Copies plugin for WordPress. It occurs due to improper neutralization of input during web page generation, specifically in admin settings. Authenticated attackers with administrator privileges can inject arbitrary scripts that execute when other users access the affected pages. This vulnerability affects multi-site installations or setups with unfiltered_html disabled. The CVSS 3.1 base score is 4.4 (medium), with attack vector network, high attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability. No patch or remediation details are provided in the available data.

An attacker with administrator-level permissions can inject persistent malicious scripts into the plugin's admin settings, which execute in the context of users visiting the affected pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity impacts as per the CVSS vector. The vulnerability does not affect availability. It only affects multi-site WordPress installations or those with unfiltered_html disabled. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the WP Delete Post Copies plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates or patches addressing this vulnerability.