Reflected XSS Vulnerability in Wptobe-signinup Plugin from NotFound
CVE-2025-30611

7.1HIGH

Key Information:

Vendor

Notfound

Status
WPtobe-signinup
Vendor
CVE Published:
3 April 2025

What is CVE-2025-30611?

A reflected cross-site scripting vulnerability exists in the Wptobe-signinup plugin, allowing attackers to inject malicious scripts through improperly sanitized input. This can lead to unauthorized actions executed within the context of an affected user’s session, potentially enabling data theft and other security exploits.

Affected Version(s)

Wptobe-signinup <= 1.1.2

References

https://patchstack.com/database/wordpress/plugin/wptobe-s...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xd4rk5id3 (Patchstack Alliance)
JSON
.