Cross-site Scripting Vulnerability in Dot HTML, PHP, XML Pages by Karimmughal
CVE-2025-52779

7.1HIGH

Key Information:

Vendor

WordPress
Status
Dot Html,PHP,xml Etc Pages
Vendor
CVE Published:
16 July 2025

What is CVE-2025-52779?

An improper neutralization of input during web page generation in the Dot HTML, PHP, XML Pages by Karimmughal allows attackers to execute a Reflected Cross-site Scripting (XSS) attack. This vulnerability impacts versions from n/a up to 1.0, enabling malicious inputs to be executed in the context of the affected web pages, posing a significant risk for users interacting with the application.

Affected Version(s)

Dot html,php,xml etc pages <= 1.0

References

https://patchstack.com/database/wordpress/plugin/dot-html...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.