CVE-2025-2077

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-207706.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207716.7In display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege iCVE-2025-207726.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207736.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207746.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2025-207756.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207766.7In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a maliCVE-2025-207776.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2025-207787.8In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2025-207797.0In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actoCVE-2025-20784.8The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inclCVE-2025-207807.8In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious act
CVE-2025-2077: Medium severity, CVSS 6.1 | Vulnix