CVE-2019-25315

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2019

CVE-2019-253166.4GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts throCVE-2019-253175.4Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptioCVE-2019-253188.8AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the ouCVE-2019-253199.8Domain Quester Pro 6.02 contains a stack overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting StructCVE-2019-25324.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affectCVE-2019-253206.5E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentialCVE-2019-253219.8FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured ExceptiCVE-2019-253227.5Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentiaCVE-2019-253236.1Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTCVE-2019-253246.1RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to injecCVE-2019-253258.2Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypassCVE-2019-253265.5ipPulse 1.92 contains a denial of service vulnerability that allows local attackers to crash the application by providing an oversized input