CVE-2025-13058

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a patch is advised to resolve this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Nov 12, 2025
Last modified
Oct 18, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-130599.8A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manaCVE-2025-13068.8The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to mCVE-2025-130609.8A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /viCVE-2025-130618.8A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_vCVE-2025-130628.8The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is dCVE-2025-130637.3A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorizCVE-2025-130644.5A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by CVE-2025-130658.8The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due CVE-2025-130668.8The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due CVE-2025-130678.8The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. TCVE-2025-130687.2The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username in all versions up toCVE-2025-130698.8The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3