CVE-2025-5533

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-553304.6Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physicaCVE-2025-553317.0Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-553324.6Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physicaCVE-2025-553334.6Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physicalCVE-2025-553345.5Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.CVE-2025-553357.0Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.CVE-2025-553365.5Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to discloCVE-2025-553374.6Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physicaCVE-2025-553384.6Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-553397.8Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally.CVE-2025-55346.4The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in CVE-2025-553407.0Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally.
CVE-2025-5533: Medium severity, CVSS 6.4 | Vulnix