Cross-site Scripting Vulnerability in CM On Demand Search And Replace by CreativeMindsSolutions
CVE-2025-54727

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Cm On Demand Search And Replace
Vendor
CVE Published:
14 August 2025

What is CVE-2025-54727?

The CM On Demand Search And Replace plugin by CreativeMindsSolutions is vulnerable to a stored Cross-site Scripting (XSS) attack due to improper neutralization of user input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are executed in the context of a user's browser when they visit a compromised page. Users of the plugin are advised to take immediate action by updating to the latest version to ensure their websites remain secure against potential exploitation.

Affected Version(s)

CM On Demand Search And Replace <= 1.5.2

References

https://patchstack.com/database/wordpress/plugin/cm-on-de...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bao - BlueRock (Patchstack Alliance)
.
CVE-2025-54727 : Cross-site Scripting Vulnerability in CM On Demand Search And Replace by CreativeMindsSolutions