Stored Cross-Site Scripting Vulnerability in Color Palette Plugin for WordPress

CVE-2025-5233

What is CVE-2025-5233?

The Color Palette plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access to exploit insufficient input sanitization and output escaping via the 'hex' parameter. This flaw enables attackers to inject arbitrary web scripts into pages, which can execute whenever accessed by users. This poses a significant security risk, allowing the potential for unauthorized actions and data exposure on compromised sites.

References