CVE-2025-12671 is a stored cross-site scripting vulnerability in the WP-Iconics WordPress plugin up to version 0.0.4. The issue is due to improper neutralization of input in multiple parameters of the 'wp_iconics' shortcode, allowing authenticated users with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium impact with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode parameters. These scripts execute in the context of users viewing the pages, potentially compromising user sessions or performing unauthorized actions. The confidentiality and integrity of user data may be partially impacted, but availability is not affected. The vulnerability does not require user interaction and can be exploited remotely over the network.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict Contributor-level access to trusted users only and consider disabling or removing the WP-Iconics plugin until a fix is released. Review and sanitize any content created via the 'wp_iconics' shortcode to remove potentially malicious scripts.