CVE-2025-1064

Summary

CVE-2025-1064 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Login/Signup Popup plugin for WordPress. Versions up to and including 2.8.5 are impacted by this issue. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's xoo_el_action shortcode. This flaw allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into web pages. Execution of these scripts occurs whenever a user accesses an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.