Reflected Cross-Site Scripting Vulnerability in CM FAQ Plugin for WordPress

CVE-2025-2166

What is CVE-2025-2166?

The CM FAQ plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to exploit reflected cross-site scripting (XSS) flaws. This vulnerability is a result of the improper use of the remove_query_arg function without adequate escaping on URLs, affecting all versions up to and including 1.2.5. Attackers can leverage this flaw to inject malicious scripts into web pages, which can execute if a user is manipulated into clicking a specially crafted link. Proper security measures should be implemented to safeguard against this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References