Stored Cross-Site Scripting Vulnerability in Freemind Viewer Plugin for WordPress

CVE-2025-5536

What is CVE-2025-5536?

The Freemind Viewer plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes within the plugin’s 'freemind' shortcode. This vulnerability allows authenticated users with contributor-level access or higher to execute arbitrary scripts on affected pages. Consequently, any visitor to these pages may encounter unauthorized script execution, leading to potential data theft or session hijacking.

References