CVE-2025-3432

Summary

CVE-2025-3432 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the AAWP Obfuscator plugin for WordPress. This issue, present in all versions up to 1.0, allows authenticated attackers with Author-level access or higher to inject malicious scripts into web pages. These scripts will execute whenever an unsuspecting user accesses the manipulated page, potentially leading to data theft, unauthorized account access, or other malicious activities. The root cause is insufficient input sanitization and output escaping, enabling attackers to exploit the plugin's functionality and compromise WordPress sites.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.