Cross-Site Scripting Vulnerability in WP Codeus WP Proposals Plugin
CVE-2025-31837

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Proposals
Vendor
CVE Published:
1 April 2025

What is CVE-2025-31837?

A vulnerability exists in the WP Codeus WP Proposals plugin that allows for stored Cross-Site Scripting (XSS) attacks. This security flaw enables the injection of malicious scripts into web pages generated by the plugin, potentially compromising the security and integrity of WordPress installations. Affected versions include all releases from not applicable (n/a) through version 2.3. Users of the plugin are strongly encouraged to update to the latest version to mitigate this risk.

Affected Version(s)

WP Proposals <= 2.3

References

https://patchstack.com/database/wordpress/plugin/wp-propo...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

savphill (Patchstack Alliance)
JSON
.