CVE-2025-0687

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-06886.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o CVE-2025-06897.8When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buf CVE-2025-06906.1The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is CVE-2025-06915.0Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "E CVE-2025-06923.5The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high CVE-2025-06935.3Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid I CVE-2025-06946.6Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.CVE-2025-06955.3An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce CVE-2025-06965.3A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embe CVE-2025-06975.3A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115. This affects an unknown part of CVE-2025-06988.8A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected CVE-2025-06998.8A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected b