XSS Vulnerability in Dynamic Content Generation for WordPress Plugin
CVE-2025-41681

4.8MEDIUM

Key Information:

Vendor

Mb Connect Line

Status
Mbnet.mini
Rex 100
Vendor
CVE Published:
21 July 2025

What is CVE-2025-41681?

A remote attacker with elevated privileges can exploit a persistent XSS vulnerability due to inadequate sanitization of special elements used in dynamic content generation. This flaw allows attackers to inject malicious scripts via POST requests, potentially compromising the integrity and security of the affected WordPress plugin. Without proper remediation, this vulnerability may allow unauthorized access and manipulation of user interactions.

Affected Version(s)

mbNET.mini 0.0.0 < 2.3.3

REX 100 0.0.0 < 2.3.3

References

https://certvde.com/de/advisories/VDE-2025-058

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
.
CVE-2025-41681 : XSS Vulnerability in Dynamic Content Generation for WordPress Plugin