CVE-2025-12096 is a stored cross-site scripting vulnerability in the Simple Excel Pricelist for WooCommerce plugin for WordPress, affecting all versions up to and including 1.13. The issue stems from improper neutralization of input during web page generation, specifically in the 'pricelist' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to theft of user credentials, session tokens, or other sensitive information accessible through the browser context. The CVSS score of 6.4 reflects a medium severity with low complexity and no user interaction required. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the 'pricelist' shortcode functionality if feasible. Monitor for updates from the plugin vendor or WordPress security advisories to apply any forthcoming patches promptly.