Reflected Cross-Site Scripting Vulnerability in myLCO Plugin for WordPress

CVE-2025-13626

What is CVE-2025-13626?

The myLCO plugin for WordPress has a vulnerability that allows reflected cross-site scripting (XSS) attacks through the $_SERVER['PHP_SELF'] parameter. This issue emerges due to inadequate input sanitization and output escaping across all versions up to 0.8.1. Malicious actors can exploit this flaw to inject arbitrary web scripts, which execute when users are tricked into clicking on a specially crafted link. Proper mitigation involves ensuring comprehensive input validation and output encoding to safeguard user interactions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References