CVE-2025-12746: Php Tainted Html Attribute Xss
User input from superglobals was found flowing into an output statement ('echo' or 'print') with either no escaping or insufficient escaping. Notably, 'htmlspecialchars()' without the 'ENT_QUOTES' flag does not escape single quotes, allowing XSS breakouts when embedded inside single-quoted HTML attributes. Use 'esc_attr()', 'esc_html()', or 'htmlspecialchars
PHPβgreprules fetch cve-2025-12746-php-tainted-html-attribute-xss --engine opengrepDescription
User input from superglobals was found flowing into an output statement ('echo' or 'print') with either no escaping or insufficient escaping. Notably, 'htmlspecialchars()' without the 'ENT_QUOTES' flag does not escape single quotes, allowing XSS breakouts when embedded inside single-quoted HTML attributes. Use 'esc_attr()', 'esc_html()', or 'htmlspecialchars
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0