CVE-2025-1453
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Published Apr 24, 2025
Updated: May 7, 2025
CWE ID 79
Summary
CVE-2025-1453 is a vulnerability affecting the Category Posts Widget plugin for WordPress before version 4.9.20. Despite the unfiltered_html capability being disallowed, particularly in multisite setups, this issue fails to sanitize and escape some of its settings, making it susceptible to Stored Cross-Site Scripting attacks. High privilege users, such as admins, can exploit this flaw to inject malicious scripts, potentially compromising the entire WordPress site.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.