CVE-2025-12711 is a stored cross-site scripting vulnerability in the Share to Google Classroom WordPress plugin (versions up to 1.0). The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the share_to_google shortcode. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. This can lead to information disclosure and potential session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with network attack vector, low attack complexity, and no requirement for user interaction. No patch or official remediation has been published by the vendor as of the provided data.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject persistent malicious scripts into pages via the share_to_google shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure and integrity compromise of user sessions or data. The vulnerability does not impact system availability. No known exploits have been reported in the wild.

No official patch or fix is currently available for this vulnerability. Users should restrict Contributor-level and higher access to trusted individuals until a vendor fix is released. Monitor the vendor's advisory channels for updates regarding remediation. Avoid using the share_to_google shortcode with untrusted input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.