What is the CVSS score of CVE-2025-12834?

CVE-2025-12834 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-12834

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-12 security@wordfence.com

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 6.1

DescriptionCVE.org

The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected cross-site scripting (XSS) in Accept Stripe Payments Using Contact Form 7 WordPress plugin versions up to 3.1 allows unauthenticated attackers to inject arbitrary JavaScript via the 'failure_message' parameter due to insufficient input sanitization and output escaping. An attacker can craft a malicious link that, when clicked by a victim, executes JavaScript in the victim's browser session with access to sensitive data or session tokens. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw. The Accept Stripe Payments Using Contact Form 7 plugin, which integrates Stripe payment processing with Contact Form 7, fails to properly sanitize and escape the 'failure_message' parameter before outputting it in HTML context. The vulnerable code path is in class.cf7sa.lib.php (line 696 per the plugin repository reference), where user-supplied input is reflected directly into the page response without adequate sanitization via functions like sanitize_text_field() or escaping via wp_kses_post(). WordPress plugins must follow strict output escaping practices (esc_html(), esc_attr(), wp_kses_post()) to prevent XSS, particularly for parameters exposed in URLs or form submissions.

Affected ProductsAI

The Accept Stripe Payments Using Contact Form 7 WordPress plugin is affected in all versions up to and including 3.1. This plugin extends Contact Form 7 to accept Stripe payments and is distributed through the official WordPress plugin repository (https://plugins.trac.wordpress.org/browser/accept-stripe-payments-using-contact-form-7/). Wordfence reported the vulnerability with reference ID d9e77e3f-dcd8-426a-be0f-24eb65c6709e, and the plugin repository references changeset 3418155 and line 696 of class.cf7sa.lib.php as the vulnerable code location.

RemediationAI

Update the Accept Stripe Payments Using Contact Form 7 plugin to a patched version released after 3.1. The WordPress plugin repository changeset 3418155 indicates a fix has been committed; install the latest available version of the plugin via WordPress admin dashboard (Plugins > Updates) or manually download the patched version from https://plugins.trac.wordpress.org/. Ensure the 'failure_message' parameter and all user-controlled input is properly sanitized using WordPress sanitization functions (sanitize_text_field(), sanitize_textarea_field()) on input and escaped using appropriate escaping functions (esc_html(), esc_attr(), wp_kses_post()) on output before rendering in HTML. As an interim mitigation, disable the plugin if not actively required, or restrict access to payment pages via IP whitelisting or authentication until patched. For additional guidance, reference Wordfence's vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e.