CVE-2025-9541

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-95425.4The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable tCVE-2025-95433.5The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow higCVE-2025-95446.5The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nCVE-2025-95485.5A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticatedCVE-2025-95496.5Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.CVE-2025-95506.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site ScriptCVE-2025-95516.5Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects ProtCVE-2025-95525.3Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.CVE-2025-95535.3Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.CVE-2025-95545.3Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.CVE-2025-95569.8Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports CVE-2025-95577.6‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬