CVE-2025-3749
CVSS 3.1 Score 6.4 of 10 (medium)
Details
Published Apr 24, 2025
Updated: Apr 29, 2025
CWE ID 79
Summary
CVE-2025-3749 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Breeze Display plugin for WordPress. The flaw, present in all versions up to 1.2.3, stems from insufficient input sanitization and output escaping. This vulnerability provides authenticated attackers with Contributor-level access or higher the ability to inject arbitrary web scripts into pages. Subsequently, these scripts will execute whenever an end user accesses an affected page.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.