CVE-2025-12660 is a stored cross-site scripting vulnerability in the Padlet Shortcode WordPress plugin (versions up to 1.3). It occurs due to improper neutralization of input in the 'key' parameter of the 'wallwisher' shortcode, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (medium severity). No patch or official remediation has been disclosed by the vendor as of the publication date.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to execution of arbitrary JavaScript in the context of other users viewing the page, potentially resulting in credential theft, session hijacking, or other client-side attacks. The impact is limited to users who have access to the injected content and depends on the privileges of the attacker to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Padlet Shortcode plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.