Cross-site Scripting Vulnerability in SEPA Girocode by mhallmann
CVE-2025-49450

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Sepa Girocode
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49450?

The SEPA Girocode plugin by mhallmann is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. This flaw arises from the improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Users running versions n/a through 0.5.1 are at risk, potentially exposing their web applications to unauthorized access and data breaches. It is crucial for administrators to review and update their installations to mitigate this risk.

Affected Version(s)

SEPA Girocode <= 0.5.1

References

https://patchstack.com/database/wordpress/plugin/sepa-gir...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chu The Anh (Blue Rock) (Patchstack Alliance)
.
CVE-2025-49450 : Cross-site Scripting Vulnerability in SEPA Girocode by mhallmann