Stored Cross-Site Scripting in Companion Auto Update Plugin for WordPress

CVE-2025-4369

What is CVE-2025-4369?

The Companion Auto Update plugin for WordPress is vulnerable to a Stored Cross-Site Scripting attack through the ‘update_delay_days’ parameter. This vulnerability arises from inadequate input sanitization and output escaping practices within all versions leading up to 3.9.2. Attackers with administrator-level access can exploit this weakness to inject malicious web scripts, which will execute on pages accessed by users within multi-site installations or where unfiltered_html has been disabled. Proper remediation is critical to safeguard against potential script injections that could compromise website security.

References