CVE-2025-12651 is a stored cross-site scripting vulnerability in the eggemplo Live Photos on WordPress plugin affecting all versions up to 0.1. The issue is due to improper neutralization of input during web page generation (CWE-79), specifically in the 'video_src', 'img_src', and 'class' parameters of the livephotos_photo shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts within WordPress pages using the vulnerable shortcode parameters. When other users access these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, data theft, or other malicious actions impacting confidentiality and integrity. There is no direct impact on system availability. No known exploits in the wild have been reported at this time.

No official patch or fix is currently available for this vulnerability. Users should restrict contributor-level access to trusted individuals and consider disabling or removing the Live Photos on WordPress plugin until a vendor-provided fix is released. Monitor the vendor's advisory channels for updates regarding patches or official remediation guidance. Since this is a stored XSS vulnerability requiring authenticated access, limiting user privileges is a key interim mitigation.