CVE-2025-15690

MediumCVSS 6.8/10Last modified Oct 19, 2026

Description

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownContent Mask>= 1.7.1, < 1.8.5.6

References

Timeline

Published
Sep 9, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-156915.3The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from CVE-2025-156923.5The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML atCVE-2025-156932.7The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsCVE-2025-156943.5The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admiCVE-2025-156953.5The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scCVE-2025-156966.8The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in thCVE-2025-156977.1The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessCVE-2025-156983.5The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilegeCVE-2025-15709.8The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalatioCVE-2025-157008.8The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listCVE-2025-157013.5The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end paCVE-2025-157028.8The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing u
CVE-2025-15690: Medium severity, CVSS 6.8 | Vulnix