Stored Cross-Site Scripting Vulnerability in WordPress Plugins

CVE-2025-2540

What is CVE-2025-2540?

Several WordPress plugins are exposed to a Stored Cross-Site Scripting flaw caused by the bundled prettyPhoto library version 3.1.6. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes. It enables authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages, leading to execution when users access those compromised pages. Prompt action is advisable to mitigate the risks posed by this vulnerability.

References