Reflected XSS Vulnerability in Frizzly Plugin by NotFound
CVE-2025-30554

7.1HIGH

Key Information:

Vendor

Notfound

Status
Frizzly
Vendor
CVE Published:
1 April 2025

What is CVE-2025-30554?

An improper neutralization of user input during web page generation in the Frizzly plugin allows for reflected XSS attacks. This vulnerability can be exploited by attackers to inject malicious scripts into web pages that are viewed by users, allowing unauthorized access to user data or manipulation of the website behavior. The issue affects Frizzly versions prior to 1.1.0.

Affected Version(s)

Frizzly <= 1.1.0

References

https://patchstack.com/database/wordpress/plugin/frizzly/...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.