CVE-2025-12079 is a reflected cross-site scripting vulnerability (CWE-79) in the WP Twitter Auto Publish plugin for WordPress. The flaw arises from improper neutralization of input during web page generation, specifically in the handling of PostMessage data. Attackers can exploit this by crafting malicious links that, when clicked by users, execute arbitrary scripts in the context of the affected site. This affects all versions up to and including 1.7.4. The vulnerability requires user interaction but no authentication, and it impacts confidentiality and integrity with no availability impact.

Successful exploitation can lead to the execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information or manipulation of the user interface. The CVSS score of 6.1 reflects a medium severity with low complexity and no privileges required but requiring user interaction. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the WP Twitter Auto Publish plugin and consider disabling or removing the plugin if possible. Monitoring vendor channels for updates is recommended.