CVE-2025-12904 is a stored cross-site scripting vulnerability in the SNORDIAN's H5PxAPIkatchu WordPress plugin (versions up to 0.4.17). The issue occurs due to improper neutralization of input in the 'insert_data' AJAX endpoint, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. There is no indication of known exploits in the wild or available patches at this time.

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected AJAX endpoint or applying web application firewall (WAF) rules to detect and block malicious input targeting the 'insert_data' endpoint. Monitor official vendor channels for updates and patches.