Stored Cross-Site Scripting Vulnerability in Formality Plugin for WordPress

CVE-2025-3858

What is CVE-2025-3858?

The Formality plugin for WordPress contains a stored cross-site scripting vulnerability that can be exploited through the 'align' parameter. This issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts can execute when users visit the compromised pages, potentially leading to unauthorized actions or data exposure.

References