CVE-2025-4168

MEDIUM Year: 2025
CVSS v3 Score
6.4
Medium
Weakness Type
CWE-80
View all →

Vulnerability Description

The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Related Vulnerabilities

CVE-2024-10592

MEDIUM
CVSS:6.4(Medium)

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization a...

CWE-802024

CVE-2024-10621

MEDIUM
CVSS:6.4(Medium)

The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient...

CWE-802024

CVE-2024-2423

MEDIUM
CVSS:6.4(Medium)

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcod...

CWE-802024

CVE-2024-2868

MEDIUM
CVSS:6.4(Medium)

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slitems ...

CWE-802024

CVE-2025-3521

MEDIUM
CVSS:6.4(Medium)

The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up ...

CWE-802025

CVE-2025-4126

MEDIUM
CVSS:6.4(Medium)

The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization a...

CWE-802025