CVE-2025-5841

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-584107.5Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exportCVE-2025-584118.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counCVE-2025-584126.1A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thrCVE-2025-584137.5A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, CVE-2025-58425.4The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to,CVE-2025-584222.3RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middlCVE-2025-584238.8Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, trCVE-2025-584245.3On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message iCVE-2025-584265.3desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applicatioCVE-2025-584277.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-584289.9The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enabCVE-2025-584297.5A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthen