CVE-2025-69011

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WPKube	Cool Tag Cloud	<= 2.29

References

https://patchstack.com/database/Wordpress/Plugin/cool-tag-cloud/vulnerability/wordpress-cool-tag-cloud-plugin-2-29-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-690124.3Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Contro CVE-2025-690134.3Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2025-690144.9Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: f CVE-2025-690153.8Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Contro CVE-2025-690164.3Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly CVE-2025-690176.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress all CVE-2025-690186.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-direct CVE-2025-690196.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook CVE-2025-69029.8A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2025-690206.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newslet CVE-2025-690215.4Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popu CVE-2025-690225.4Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrec