CVE-2025-12416 describes a vulnerability in the Pagerank Tools WordPress plugin (versions up to 1.1.5) where the pr_save_settings() function lacks nonce validation and proper input sanitization. This allows an attacker to perform a CSRF attack that results in stored XSS, enabling injection of malicious scripts that execute upon visiting the plugin's settings page. The vulnerability has a CVSS 3.1 score of 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an unauthenticated attacker to inject persistent malicious scripts into the plugin's settings page via a forged request. These scripts execute in the context of users who visit the settings page, potentially leading to information disclosure or integrity compromise of the affected site. There is no known exploitation in the wild reported at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict access to the plugin's settings page to trusted administrators only and avoid clicking on suspicious links that could trigger CSRF attacks.