Reflected Cross-Site Scripting Vulnerability in Advanced AJAX Product Filters for WordPress
CVE-2025-1505
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 February 2025
What is CVE-2025-1505?
The Advanced AJAX Product Filters plugin for WordPress is susceptible to Reflected Cross-Site Scripting (XSS) through the 'nonce' parameter. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject harmful web scripts into web pages. If a user is manipulated into interacting with a malicious link, the injected scripts could execute within their browser session, posing significant security risks.
Affected Version(s)
Advanced AJAX Product Filters * <= 1.6.8.1