CVE-2025-12135 is a stored cross-site scripting vulnerability in the WPBookit plugin for WordPress, affecting all versions up to and including 1.0.6. The issue arises from a missing capability check in the save_custome_code() function, which processes the 'css_code' parameter. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability is classified under CWE-79 and has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting affected pages, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality and integrity. There is no impact on availability. The vulnerability affects all users of the WPBookit plugin up to version 1.0.6. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality where possible and monitor for suspicious activity related to script injection. Avoid using affected versions of WPBookit or consider disabling the plugin temporarily if feasible.