Cross-site Scripting Vulnerability in Beam me up Scotty - Back to Top Button by Out the Box
CVE-2025-31864

5.9MEDIUM

Key Information:

Vendor
Out The Box
Status
Beam Me Up Scotty – Back To Top Button
Vendor
CVE Published:
1 April 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Beam me up Scotty - Back to Top Button, developed by Out the Box, contains a vulnerability that allows for Stored Cross-site Scripting (XSS). This occurs due to improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts into web pages. This issue affects all versions of the plugin up to and including 1.0.23, making it imperative for users to update promptly to mitigate any security risks.

Affected Version(s)

Beam me up Scotty – Back to Top Button <= 1.0.23

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-31864
Created by DoTTak

References

https://patchstack.com/database/wordpress/plugin/beam-me-...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Webula (Patchstack Alliance)
.