Cross-site Scripting Vulnerability in Goracash by Davaxi
CVE-2025-53458

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Goracash
Vendor
CVE Published:
22 September 2025

What is CVE-2025-53458?

The Goracash plugin by Davaxi contains a Cross-site Scripting (XSS) vulnerability that enables an attacker to execute malicious scripts in the context of unsuspecting users. This flaw allows for the storage and execution of harmful scripts, potentially leading to the compromise of user data and session hijacking. Affected versions are from n/a through 1.1. It's critical for users to implement security measures to mitigate this risk.

Affected Version(s)

Goracash <= 1.1

References

https://patchstack.com/database/wordpress/plugin/goracash...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vinit Lakra (Patchstack Alliance)
.