CVE-2025-12473 is a reflected cross-site scripting vulnerability in the RTMKit plugin for WordPress, affecting all versions up to and including 1.6.8. The issue stems from improper neutralization of input in the 'themebuilder' parameter, allowing injection of malicious scripts that execute when an administrator interacts with a crafted link. The vulnerability requires user interaction (UI:R) and has network attack vector (AV:N) with low attack complexity (AC:L). It impacts confidentiality and integrity but not availability, with a CVSS v3.1 score of 6.1.

An attacker can execute arbitrary scripts in the context of an administrator's browser session by exploiting the reflected XSS vulnerability. This can lead to partial compromise of confidentiality and integrity, such as session hijacking or unauthorized actions performed with administrator privileges. There is no direct impact on system availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links containing the 'themebuilder' parameter. Monitoring vendor communications for updates and applying any future patches promptly is recommended.