CVE-2025-1453

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownCategory Posts Widget< 4.9.20

References

Timeline

Published
Apr 24, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-145307.2A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the fiCVE-2025-145314.3A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of thCVE-2025-145329.8DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restrictionCVE-2025-145339.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.CVE-2025-145349.8A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap ofCVE-2025-145359.8A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirectCVE-2025-145369.8A security flaw has been discovered in code-projects Class and Exam Timetable Management 1.0. Affected by this vulnerability is an unknown fCVE-2025-145379.8A weakness has been identified in code-projects Class and Exam Timetable Management 1.0. Affected by this issue is some unknown functionalitCVE-2025-145383.5A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file CusCVE-2025-145395.4The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This iCVE-2025-14545.4The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users sucCVE-2025-145404.3The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json fu