CVE-2025-9277

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-92787.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the CVE-2025-92797.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP CVE-2025-92807.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the CVE-2025-92817.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensi CVE-2025-92827.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensi CVE-2025-92837.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP CVE-2025-92869.8The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rese CVE-2025-92879.1Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.CVE-2025-92889.1Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.CVE-2025-92894.7A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitati CVE-2025-92905.9An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handl CVE-2025-92916.5A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verif