CVE-2025-4126

MEDIUM Year: 2025
CVSS v3 Score
6.4
Medium
Weakness Type
CWE-80
View all →

Vulnerability Description

The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_title function. This makes it possible for authenticated attackers - with contributor-level access and above, on sites with the Classic Editor plugin activated - to inject arbitrary JavaScript code in the titletag attribute that will execute whenever a user access an injected page.

Related Vulnerabilities

CVE-2024-10592

MEDIUM
CVSS:6.4(Medium)

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization a...

CWE-802024

CVE-2024-10621

MEDIUM
CVSS:6.4(Medium)

The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient...

CWE-802024

CVE-2024-2423

MEDIUM
CVSS:6.4(Medium)

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcod...

CWE-802024

CVE-2024-2868

MEDIUM
CVSS:6.4(Medium)

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slitems ...

CWE-802024

CVE-2025-3521

MEDIUM
CVSS:6.4(Medium)

The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up ...

CWE-802025

CVE-2025-4168

MEDIUM
CVSS:6.4(Medium)

The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitizat...

CWE-802025