CVE-2025-4168

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416814.8A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to creat CVE-2025-416828.8An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.CVE-2025-416838.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416848.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416856.5A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.CVE-2025-416867.8A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.CVE-2025-416879.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected de CVE-2025-416887.2A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sand CVE-2025-416897.5An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only CVE-2025-41696.4The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all ve CVE-2025-416907.4A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the devi CVE-2025-416917.5An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending special