Cross-Site Scripting Vulnerability in Brent Jett Assistant Plugin
CVE-2025-53307

7.1HIGH

Key Information:

Vendor

WordPress
Status
Assistant
Vendor
CVE Published:
5 September 2025

What is CVE-2025-53307?

A Cross-Site Scripting (XSS) vulnerability exists in the Brent Jett Assistant plugin, allowing attackers to inject malicious scripts into web pages. This reflected XSS can be exploited when a user interacts with a compromised link, potentially leading to unauthorized actions or data exposure. The vulnerability impacts all versions of the plugin up to and including 1.5.2, emphasizing the need for immediate updates to protect against potential exploitation.

Affected Version(s)

Assistant <= 1.5.2

References

https://patchstack.com/database/wordpress/plugin/assistan...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Martin Herancourt (Patchstack Alliance)
.
CVE-2025-53307 : Cross-Site Scripting Vulnerability in Brent Jett Assistant Plugin