CVE-2025-12185 is a stored Cross-Site Scripting vulnerability in the era404 StaffList WordPress plugin versions up to 3.2.6. It arises from improper neutralization of input during web page generation (CWE-79), specifically in admin settings. Authenticated users with administrator-level permissions can inject arbitrary scripts that execute in the context of users visiting the injected pages. This vulnerability only impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and no user interaction required.

An authenticated administrator can inject malicious scripts into pages via the StaffList plugin settings, which execute when other users access those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of affected users. Availability is not impacted. The vulnerability is limited to multi-site or restricted HTML capability environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the StaffList plugin in multi-site or unfiltered_html-disabled environments to prevent exploitation.