CVE-2025-12499 is a stored Cross-Site Scripting vulnerability in the Rich Shortcodes for Google Reviews WordPress plugin by widgetpack. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), specifically insufficient sanitization and escaping of Google Review content. This flaw enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. Although a partial fix was applied in version 6.6.2, versions up to and including 6.8 remain vulnerable. The CVSS 3.1 base score is 7.2 (High), reflecting network exploitable, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. No vendor advisory or patch links are provided, and no known exploits in the wild are reported.

Successful exploitation allows unauthenticated attackers to perform stored XSS attacks, potentially leading to theft of user credentials, session hijacking, or other malicious actions executed in the context of the victim's browser. The vulnerability affects confidentiality and integrity but does not impact availability. The high CVSS score reflects the ease of exploitation and potential impact on users of affected sites.

No official patch or full remediation is confirmed in the provided data. The vulnerability was partially patched in version 6.6.2, but versions up to 6.8 remain vulnerable. Users should verify with the vendor or plugin maintainers for updated patches or security advisories. Until a full fix is available, consider disabling or removing the plugin or restricting access to affected pages to trusted users only. Monitor vendor channels for official updates.