CVE-2025-12186 is a stored cross-site scripting vulnerability in the Weekly Planner plugin for WordPress, affecting all versions up to 1.0. The flaw is due to improper neutralization of input during web page generation, specifically in the admin settings interface. Authenticated users with administrator permissions can inject arbitrary web scripts that execute when other users access the affected pages. This vulnerability impacts multi-site WordPress setups and installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can inject malicious scripts into the plugin's admin settings, which will execute in the context of users viewing the affected pages. This could lead to partial compromise of confidentiality and integrity of the affected WordPress site. The vulnerability does not affect availability and requires high privileges, limiting the attack surface. It only impacts multi-site installations or those with unfiltered_html disabled, reducing the scope of affected environments.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory channels for updates. Until a fix is released, restricting administrator access to trusted users and limiting multi-site usage or configurations with unfiltered_html disabled may reduce risk. Because this vulnerability requires administrator privileges, ensuring strong access controls and auditing administrator actions can help mitigate potential exploitation.