CVE-2025-1303

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Plugin Oficial	<= 1.7.3

References

https://wpscan.com/vulnerability/35181798-4f21-4c8d-bb6e-61eb13683a74/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/35181798-4f21-4c8d-bb6e-61eb13683a74/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-130309.8All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An CVE-2025-130315.9The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high priv CVE-2025-130327.8Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflo CVE-2025-130337.5A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An at CVE-2025-130345.9When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the ser CVE-2025-130358.0The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the p CVE-2025-130369.2An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpo CVE-2025-13048.8The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and CVE-2025-130428.8Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption CVE-2025-130446.2IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a CVE-2025-130486.4The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in CVE-2025-13058.8The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due t