Reflected Cross-Site Scripting in Top Position Google Finance Plugin for WordPress

CVE-2025-13895

What is CVE-2025-13895?

The Top Position Google Finance plugin for WordPress exhibits a vulnerability allowing reflected cross-site scripting due to inadequate input validation and output filtering. Attackers can exploit this flaw through the $_SERVER['PHP_SELF'] variable, enabling them to inject harmful scripts. If users are deceived into interacting with compromised links, their sessions could be hijacked or malicious scripts executed in their browsers. All versions of the plugin up to and including 0.1.0 are affected, emphasizing the need for site administrators to ensure their plugins are updated and to implement the necessary security measures.

References