CVE-2025-25092

Summary

CVE-2025-25092 is a Cross-Site Scripting (XSS) vulnerability affecting the gtlwpdev All push notification for WP plugin. The issue lies in the improper neutralization of user inputs during web page generation. This vulnerability enables attackers to inject malicious scripts into the affected plugin, potentially leading to data theft or unauthorized access to user sessions when a user visits a specially crafted webpage. The affected versions of the plugin range from n/a to 1.5.3. Users are strongly advised to update to the latest patched version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.