Reflected XSS Vulnerability in KNR Author List Widget by Yamna Tatheer
CVE-2025-22514

7.1HIGH

Key Information:

Vendor

WordPress
Status
Knr Author List Widget
Vendor
CVE Published:
13 January 2025

What is CVE-2025-22514?

A reflected Cross-site Scripting (XSS) vulnerability exists in the KNR Author List Widget developed by Yamna Tatheer. This security flaw arises from the improper neutralization of user input during web page generation, allowing attackers to execute malicious scripts in the context of users accessing affected versions. The vulnerability impacts KNR Author List Widget versions up to and including 3.1.1, potentially exposing users to a range of security risks. It is essential for users to update to the latest version of this plugin to mitigate the threat.

Affected Version(s)

KNR Author List Widget <= 3.1.1

References

https://patchstack.com/database/wordpress/plugin/knr-auth...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) (Patchstack Alliance)
.