CVE-2025-1401

Summary

CVE-2025-1401 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WP Click Info WordPress plugin up to version 2.7.4. This issue allows an attacker to inject malicious scripts into a webpage viewed by other users. The vulnerability stems from the plugin's failure to sanitize and escape a user input parameter before displaying it on the page. High privilege users, such as administrators, are particularly at risk due to their elevated access levels. Successful exploitation of this vulnerability could lead to unauthorized account takeover or data exfiltration.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.