CVE-2012-5325

CVE-2012-5325 describes multiple cross-site scripting (XSS) vulnerabilities within the Shortcode Redirect plugin (versions 1.0.01 and earlier) for WordPress. Specifically, the scr_do_redirect function in scr.php allows authenticated users with specific permissions to inject malicious web scripts or HTML through the 'url' or 'sec' attributes of a redirect tag. The vulnerability has a low severity CVSS score of 2.1, indicating a network-based attack with high access complexity, requiring authentication, and resulting in only partial integrity impact (no confidentiality or availability impact). Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the KEV catalog. Community discussion and media coverage are also absent, indicating a lack of widespread attention or exploitation.