CVE-2025-12717 is a stored cross-site scripting vulnerability in the List Attachments Shortcode WordPress plugin (versions up to 0.4.1a). The flaw exists in the handling of the 'before_list' parameter in the [list-attachments] shortcode, where input is not properly sanitized or escaped before output. This allows authenticated attackers with Author-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with Author-level access or above can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users, potentially compromising user data confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the List Attachments Shortcode plugin if possible to prevent exploitation.