CVE-2025-1798

Description

The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.

Reserved 2025-02-28 | Published 2025-03-25 | Updated 2025-03-25 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 1.1.2
affected

Credits

Filippo Decortes (Bitcube Security) finder

WPScan coordinator

References

wpscan.com/...rability/c5c30191-857c-419c-9096-d1fe14d34eaa/ exploit vdb-entry technical-description

cve.org (CVE-2025-1798)

nvd.nist.gov (CVE-2025-1798)

Download JSON