Reflected Cross-Site Scripting Vulnerability in HandL UTM Grabber / Tracker Plugin
CVE-2025-13072
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 December 2025
Badges
What is CVE-2025-13072?
The HandL UTM Grabber / Tracker plugin for WordPress prior to version 2.8.1 is vulnerable due to improper sanitization and escaping of user-supplied parameters. This oversight allows an attacker to initiate a reflected cross-site scripting attack, particularly targeting users with high privileges, such as administrators. By exploiting this vulnerability, malicious actors could execute arbitrary scripts in the context of the user's browser, potentially leading to unauthorized actions and compromise of sensitive data.
Affected Version(s)
HandL UTM Grabber / Tracker 0 < 2.8.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.