Reflected XSS Vulnerability in xili-dictionary by xiligroup
CVE-2025-52778

7.1HIGH

Key Information:

Vendor

WordPress
Status
Xili-dictionary
Vendor
CVE Published:
27 June 2025

What is CVE-2025-52778?

The xili-dictionary plugin by xiligroup contains a vulnerability that allows for reflected cross-site scripting (XSS). This occurs due to improper handling of user input during web page generation, potentially enabling attackers to inject malicious scripts into the net application. Affected users using versions from n/a to 2.12.5.2 are advised to implement security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

xili-dictionary <= 2.12.5.2

References

https://patchstack.com/database/wordpress/plugin/xili-dic...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.
CVE-2025-52778 : Reflected XSS Vulnerability in xili-dictionary by xiligroup