Cross-site Scripting Vulnerability in Profile Widget Ninja by Pankaj Mondal
CVE-2025-27320

6.5MEDIUM

Key Information:

Vendor
Pankaj Mondal
Status
Profile Widget Ninja
Vendor
CVE Published:
24 February 2025

Summary

A Cross-site Scripting (XSS) vulnerability exists in the Profile Widget Ninja plugin by Pankaj Mondal, particularly affecting versions from n/a up to 4.3. This flaw allows attackers to manipulate web page content and execute arbitrary scripts within the browser of a user visiting the affected site, compromising the security and confidentiality of user data. It is essential for users of the plugin to review their installations and apply necessary security measures to mitigate potential exploitation.

Affected Version(s)

Profile Widget Ninja <= 4.3

References

https://patchstack.com/database/wordpress/plugin/profile-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
.