CVE-2025-1513

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Feb 28, 2025
Updated: Mar 6, 2025
CWE ID 79

Summary

CVE-2025-1513: This vulnerability affects the Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery plugin for WordPress. The issue lies in the insufficient input sanitization and output escaping of the Name and Comment field when commenting on photo gallery entries. As a result, unauthenticated attackers can inject arbitrary web scripts, which will execute whenever a user accesses an injected page, posing a significant cross-site scripting risk. Versions up to and including 26.0.0.1 are vulnerable.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share