Stored Cross-Site Scripting in Include Fussball.de Widgets for WordPress

CVE-2025-11129

What is CVE-2025-11129?

The Include Fussball.de Widgets plugin for WordPress is susceptible to stored cross-site scripting, particularly through the 'api' and 'type' parameters. This vulnerability affects all versions up to and including 4.0.0, as it arises from inadequate input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can exploit this weakness to inject arbitrary scripts into web pages. Consequently, these scripts may execute whenever a user accesses the compromised page, leading to a potential breach of user data or site functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References