CVE-2025-6257

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-625705.5Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.CVE-2025-625717.8Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2025-625727.8Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally.CVE-2025-625737.0Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2025-625758.8NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created account CVE-2025-625778.4ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to CVE-2025-625787.5DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information CVE-2025-625797.8ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2025-62586.4The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions CVE-2025-625807.8ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2025-625819.8Delta Electronics DIAView has multiple vulnerabilities.CVE-2025-625829.8Delta Electronics DIAView has multiple vulnerabilities.