Cross-site Scripting Vulnerability in Statify Widget by Finn Dohrn
CVE-2025-48322

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Statify Widget
Vendor
CVE Published:
28 August 2025

What is CVE-2025-48322?

A Cross-site Scripting (XSS) vulnerability exists in the Statify Widget developed by Finn Dohrn, which allows attackers to execute arbitrary scripts in the context of users' browsers. The vulnerability arises due to improper neutralization of input during web page generation. This issue poses a significant security risk as it enables stored XSS attacks, potentially leading to unauthorized data access and manipulation for users interacting with the compromised widget.

Affected Version(s)

Statify Widget <= 1.4.6

References

https://patchstack.com/database/wordpress/plugin/statify-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17 (Patchstack Alliance)
.