Stored Cross-Site Scripting Vulnerability in Breeze Display Plugin by WordPress

CVE-2025-3749

What is CVE-2025-3749?

The Breeze Display plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access to execute arbitrary web scripts by exploiting insufficient input sanitization and output escaping in the 'cal_size' parameter. When a user accesses a manipulated page, these scripts can create security risks, potentially leading to data exposure or unauthorized actions. It's crucial for users of affected versions to apply necessary updates to mitigate this risk.

References