CVE-2025-23876

Summary

CVE-2025-23876 is a Cross-site Scripting (XSS) vulnerability affecting the WP krpano plugin. Hackers can exploit this flaw, present from an unknown version up to 1.2.1, to inject malicious scripts into web pages generated by the plugin. The vulnerability occurs due to improper neutralization of user inputs during the web page generation process, potentially leading to unintended execution of malicious code in the context of affected users. This puts websites using the WP krpano plugin at risk of data theft, account takeover, and other malicious activities. Users are strongly advised to update to the latest version of the plugin to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.