CVE-2025-12670 is a stored cross-site scripting vulnerability in the realin wp-twitpic WordPress plugin affecting all versions up to and including 1.0. The issue arises from improper neutralization of input during web page generation, specifically in multiple parameters of the 'twitpic' shortcode. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with Contributor or higher roles to inject persistent malicious scripts into pages using the 'twitpic' shortcode. This can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in other users' browsers. There is no impact on availability. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict Contributor-level access if possible and avoid using the 'twitpic' shortcode until a fix is released. Review and sanitize user inputs related to the shortcode manually if feasible.