CVE-2025-12471

MediumCVSS 6.1

Published: 06/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

The Hubbub Lite plugin for WordPress (versions up to and including 1.36.0) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'dpsp_list_attention_search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that execute if a user is tricked into clicking a link.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or content modification. The risk affects all sites with the vulnerable plugin version installed.

Recommendation

Update the Hubbub Lite plugin to the latest version (above 1.36.0) or temporarily disable it if an update is not possible.

Other vulnerabilities in Hubbub Lite

CVE-2026-27403Medium
The Hubbub Lite plugin for WordPress (versions up to 1.36.3) contains a stored XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious scripts that execute in other users' browsers.

Original NVD description (English source)

The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsp_list_attention_search' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS