Reflected Cross-Site Scripting Vulnerability in myLCO Plugin for WordPress

CVE-2025-13626

What is CVE-2025-13626?

The myLCO plugin for WordPress has a vulnerability that allows reflected cross-site scripting (XSS) attacks through the $_SERVER['PHP_SELF'] parameter. This issue emerges due to inadequate input sanitization and output escaping across all versions up to 0.8.1. Malicious actors can exploit this flaw to inject arbitrary web scripts, which execute when users are tricked into clicking on a specially crafted link. Proper mitigation involves ensuring comprehensive input validation and output encoding to safeguard user interactions.

References