CVE-2025-2078

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-207807.8In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207817.8In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207826.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2025-207836.7In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malCVE-2025-207846.7In display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a maliciousCVE-2025-207856.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207866.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207876.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2025-207884.4In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no addCVE-2025-207894.4In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with CVE-2025-20798.7Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This cCVE-2025-207905.3In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connec
CVE-2025-2078: Medium severity, CVSS 4.8 | Vulnix