CVE-2025-12151 is a stored cross-site scripting vulnerability in the presstigers Simple Folio WordPress plugin affecting all versions up to 1.1.0. The issue stems from improper neutralization of input in the 'portfolio_name' parameter, allowing authenticated users with low privileges (Subscriber and above) to inject arbitrary web scripts. These scripts execute in the context of users who view the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with network attack vector, low attack complexity, and no user interaction required. No patch or remediation details are provided in the available data.

Successful exploitation allows an authenticated user with Subscriber-level privileges or higher to inject persistent malicious scripts into pages generated by the Simple Folio plugin. These scripts execute in the browsers of users who access the affected pages, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or monitoring user input for the 'portfolio_name' parameter and limiting Subscriber-level user capabilities if possible. Avoid granting unnecessary privileges to users. Monitor for updates from presstigers regarding a security patch or official mitigation.