Cross-site Scripting Vulnerability in LeadConnector by LeadConnector
CVE-2025-30893

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Leadconnector
Vendor
CVE Published:
27 March 2025

What is CVE-2025-30893?

The LeadConnector product is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper neutralization of user inputs during the web page generation process. This flaw allows attackers to inject malicious scripts into web applications, potentially compromising user data and session integrity. It affects all versions of LeadConnector up to 3.0.2, and poses significant security risks if left unaddressed. Maintaining vigilance and implementing security patches is crucial to safeguard against such threats.

Affected Version(s)

LeadConnector 0 <= 3.0.2

References

https://patchstack.com/database/Wordpress/Plugin/leadconn...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis (Patchstack Alliance)
.