Reflected Cross-Site Scripting Vulnerability in VR-Frases Plugin for WordPress

CVE-2025-0860

What is CVE-2025-0860?

The VR-Frases (collect & share quotes) plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to inadequate input sanitization and output escaping in several parameters. This issue exists in all versions up to and including 3.0.1. As a result, unauthenticated attackers can inject malicious web scripts into pages, which may execute if they successfully entice a user to interact with a malicious link. It is crucial for users of the plugin to apply updates and follow best practices for securing their WordPress installations.

References