Cross-Site Scripting Vulnerability in jQuery TwentyTwenty by One Plus Solution
CVE-2025-22546

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Jquery Twentytwenty
Vendor
CVE Published:
7 January 2025

What is CVE-2025-22546?

A Cross-Site Scripting (XSS) vulnerability exists in the jQuery TwentyTwenty plugin developed by One Plus Solution. This vulnerability allows attackers to inject arbitrary scripts into web pages viewed by users, potentially leading to data theft, session hijacking, or other malicious activities. The issue affects versions of jQuery TwentyTwenty from n/a through 1.0, enabling a persistent XSS vulnerability that poses significant risks to users of the affected product.

Affected Version(s)

jQuery TwentyTwenty <= 1.0

References

https://patchstack.com/database/wordpress/plugin/js-twent...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.