CVE-2025-15701

LowCVSS 3.5/10Last modified Nov 9, 2026

Description

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-157028.8The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing u CVE-2025-157033.5The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back i CVE-2025-157053.5The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the for CVE-2025-157083.5The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them CVE-2025-15715.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Imag CVE-2025-157113.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href CVE-2025-157123.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in p CVE-2025-157133.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting th CVE-2025-157143.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on CVE-2025-15728.8The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all CVE-2025-15754.3A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PA CVE-2025-15769.8A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability