CVE-2025-4169

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416907.4A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the devi CVE-2025-416917.5An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending special CVE-2025-416926.8A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS d CVE-2025-416934.3A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources CVE-2025-416946.5A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it recei CVE-2025-416957.1An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated CVE-2025-416964.6An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 CVE-2025-416976.8An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE CVE-2025-416987.8A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.CVE-2025-416998.8An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command inje CVE-2025-41706.4The Xavin's Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all ve CVE-2025-417007.8An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file