Cross-site Scripting Vulnerability in WP Custom Post Popup by gnanavelshenll
CVE-2025-46471

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
WP Custom Post Popup
Vendor
CVE Published:
24 April 2025

Summary

The WP Custom Post Popup plugin by gnanavelshenll contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This can allow attackers to inject malicious scripts into web pages displayed to users, posing a significant risk to web application security. The issue specifically affects versions from n/a through 1.0.1, and it is crucial for users to ensure their installations are patched to safeguard against potential exploits.

Affected Version(s)

WP Custom Post Popup <= 1.0.1

References

https://patchstack.com/database/wordpress/plugin/custom-p...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

johska (Patchstack Alliance)
.