Stored Cross-Site Scripting in Include Fussball.de Widgets for WordPress

CVE-2025-11129

What is CVE-2025-11129?

The Include Fussball.de Widgets plugin for WordPress is susceptible to stored cross-site scripting, particularly through the 'api' and 'type' parameters. This vulnerability affects all versions up to and including 4.0.0, as it arises from inadequate input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can exploit this weakness to inject arbitrary scripts into web pages. Consequently, these scripts may execute whenever a user accesses the compromised page, leading to a potential breach of user data or site functionality.

References