CVE-2025-12118 is a stored cross-site scripting vulnerability in the Schema Scalpel WordPress plugin by kevingillispie. The flaw arises from improper neutralization of input during web page generation (CWE-79), specifically insufficient sanitization and escaping of post titles when outputting user-supplied data into JSON-LD schema markup. Authenticated attackers with Contributor or higher privileges can inject arbitrary scripts that execute in the context of users visiting the compromised pages. The vulnerability affects all versions up to and including 1.6.1. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker with Contributor-level or higher access can inject malicious JavaScript into post titles, which is then embedded in JSON-LD schema markup on pages. This script executes in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability affects confidentiality and integrity but does not impact availability. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only. Consider removing or disabling the Schema Scalpel plugin if possible. Monitor for updates from the vendor or WordPress plugin repository to apply any forthcoming patches promptly.