CVE-2025-4170

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Xavin's Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-417007.8An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file CVE-2025-417017.8An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with CVE-2025-417029.8The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can genera CVE-2025-417037.5An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.CVE-2025-417045.3An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affe CVE-2025-417056.8An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.CVE-2025-417065.3The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an ove CVE-2025-417075.3The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket messag CVE-2025-417087.4Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same networ CVE-2025-417099.8An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affecte CVE-2025-41716.4The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CVE-2025-417106.5An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and