CVE-2025-1525

Summary

CVE-2025-1525 is a vulnerability affecting the Ultimate Dashboard plugin for WordPress before version 3.8.6. This issue permits high privilege users, including admins, to carry out Stored Cross-Site Scripting attacks. Although the unfiltered_html capability is typically disallowed, particularly in multisite configurations, the plugin fails to sanitize and escape certain settings, making these attacks possible. This flaw poses a significant security risk, as an attacker could inject malicious scripts into a website, leading to unauthorized access or data theft.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.