Stored Cross-Site Scripting Vulnerability in Modal Window Plugin for WordPress
CVE-2025-0897
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 February 2025
What is CVE-2025-0897?
The Modal Window plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'iframeBox' shortcode. Authenticated users with contributor-level privileges can exploit this vulnerability to inject malicious web scripts into pages. These scripts will execute whenever a user visits an affected page, posing a significant risk to site security and user data integrity.
Affected Version(s)
Modal Window – create popup modal window * <= 6.1.5