How severe is CVE-2025-1672?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.5 out of 10.

What type of vulnerability is CVE-2025-1672?

This is classified as CWE-79, which is a common weakness in software security.

CVE-2025-1672 - MEDIUM Severity | CVSS 5.5

Vulnerability Description

The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Related Vulnerabilities

CVE-2016-4790

MEDIUM

CVSS:5.5(Medium)

Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote ...

CWE-792016

CVE-2016-5265

MEDIUM

CVSS:5.5(Medium)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by...

CWE-792016

CVE-2018-0719

MEDIUM

CVSS:5.5(Medium)

Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on bu...

CWE-792018

CVE-2018-20244

MEDIUM

CVSS:5.5(Medium)

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CWE-792018

CVE-2018-6681

MEDIUM

CVSS:5.5(Medium)

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in th...

CWE-792018

CVE-2019-12667

MEDIUM

CVSS:5.5(Medium)

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interfa...

CWE-792019