Stored Cross-Site Scripting Vulnerability in Breeze Display Plugin by WordPress

CVE-2025-3749

What is CVE-2025-3749?

The Breeze Display plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access to execute arbitrary web scripts by exploiting insufficient input sanitization and output escaping in the 'cal_size' parameter. When a user accesses a manipulated page, these scripts can create security risks, potentially leading to data exposure or unauthorized actions. It's crucial for users of affected versions to apply necessary updates to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References