Stored Cross-Site Scripting in WP Content Security Plugin by WordPress
CVE-2025-4579

7.2HIGH

Key Information:

Vendor

WordPress
Status
WP Content Security Plugin
Vendor
CVE Published:
15 May 2025

What is CVE-2025-4579?

The WP Content Security Plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject malicious scripts. This vulnerability arises from inadequate input sanitization and output escaping in the 'blocked-uri' and 'effective-directive' parameters. As a result, when users access compromised pages, harmful scripts can execute, jeopardizing site integrity and user safety.

Affected Version(s)

WP Content Security Plugin * <= 2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-content-sec...
https://plugins.trac.wordpress.org/browser/wp-content-sec...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

anhchangmutrang
.