CVE-2025-12823

MediumCVSS 6.4

Published: 18/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.

Risk Assessment

An attacker with a Contributor account can embed malicious scripts in page content, potentially leading to session theft, account takeover, or other browser-based actions against victims. The risk affects organizations that allow low-privilege users to edit content.

Recommendation

Update the CSV to SortTable plugin to a version newer than 4.2 or remove it if not in use. Consider restricting Contributor privileges and implementing additional content validation mechanisms.

Other vulnerabilities in CSV to SortTable

CVE-2025-13070Medium
The CSV to SortTable WordPress plugin through version 4.2 does not validate some shortcode attributes before using them to generate paths passed to include functions, allowing authenticated users such as contributors to perform LFI attacks.

Original NVD description (English source)

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS