CVE-2025-8391

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-83926.4The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and CVE-2025-83937.3A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificat CVE-2025-83946.4The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortc CVE-2025-83966.9Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due CVE-2025-83976.4The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all CVE-2025-83986.4The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up CVE-2025-83996.4The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to,CVE-2025-84006.1The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to in CVE-2025-84014.3The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and CVE-2025-84024.9Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data CVE-2025-84045.5Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit st CVE-2025-84057.7GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 1