Cross-Site Scripting Vulnerability in Truong Thanh ATP Call Now
CVE-2025-50024

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Atp Call Now
Vendor
CVE Published:
20 June 2025

What is CVE-2025-50024?

The Truong Thanh ATP Call Now plugin is susceptible to a Cross-Site Scripting (XSS) vulnerability that can lead to Stored XSS. This weakness allows attackers to inject malicious scripts into web pages, compromising user interactions and data integrity. The flaw is present in versions from n/a to 1.0.3, underscoring the importance of proper input handling during web page generation to mitigate possible attacks.

Affected Version(s)

ATP Call Now <= 1.0.3

References

https://patchstack.com/database/wordpress/plugin/atp-call...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
.