Cross-site Scripting Vulnerability in WarfarePlugins Social Warfare
CVE-2025-26973

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Social Warfare
Vendor
CVE Published:
22 February 2025

What is CVE-2025-26973?

A Cross-site Scripting (XSS) vulnerability in WarfarePlugins Social Warfare allows attackers to inject malicious scripts into web pages viewed by users. This DOM-Based XSS issue affects versions from n/a up to 4.5.4, potentially allowing an attacker to execute arbitrary JavaScript in the context of the victim's session, leading to unauthorized actions or data theft. Proper sanitization of user input is imperative to mitigate the risks associated with this vulnerability.

Affected Version(s)

Social Warfare <= 4.5.4

References

https://patchstack.com/database/wordpress/plugin/social-w...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zaim (Patchstack Alliance)
.