CVE-2025-13656

MediumCVSS 6.4/10Last modified Oct 15, 2026

Description

The Cute News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2025
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-136574.3The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This CVE-2025-136589.3A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the CVE-2025-136598.8Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthentic CVE-2025-13667.8A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function st CVE-2025-136605.3The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the pl CVE-2025-136618.0Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs CVE-2025-136627.8Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 CVE-2025-136636.7Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation d CVE-2025-136646.7A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.CVE-2025-136656.7The System Console Utility for Windows is vulnerable to a DLL planting vulnerability CVE-2025-136665.3The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugi CVE-2025-136676.4The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up