Cross-site Scripting Vulnerability in WP Database Optimizer by Matthewprice1178
CVE-2025-31473

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Database Optimizer
Vendor
CVE Published:
28 March 2025

What is CVE-2025-31473?

A vulnerability has been identified in WP Database Optimizer by Matthewprice1178 that allows for improper neutralization of user input during web page generation, leading to stored Cross-site Scripting (XSS) attacks. This security flaw enables an attacker to inject malicious scripts into web pages viewed by other users, potentially compromising user data and site integrity. It affects versions from n/a through 1.2.1.3, emphasizing the need for site administrators to apply appropriate security measures and patches to protect their WordPress installations.

Affected Version(s)

WP Database Optimizer <= 1.2.1.3

References

https://patchstack.com/database/wordpress/plugin/wp-datab...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
.