Stored Cross-Site Scripting in A/B Testing Plugin for WordPress

CVE-2025-4587

What is CVE-2025-4587?

The A/B Testing for WordPress plugin has a security issue that allows for stored cross-site scripting vulnerabilities due to inadequate input sanitization and output escaping on the 'id' parameter within its 'ab-testing-for-wp/ab-test-block' functionality. Authenticated users with contributor-level access can exploit this flaw by injecting malicious web scripts into pages, compromising the site whenever a user accesses the affected page. This indicates a serious need for users to update to secure versions of the plugin and enforce stringent access controls.

References