Stored Cross-Site Scripting in SiteOrigin Widgets Bundle for WordPress

CVE-2025-5585

What is CVE-2025-5585?

The SiteOrigin Widgets Bundle plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input validation and output encoding in the data-url DOM Element Attribute. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. When these pages are accessed by users, the injected scripts are executed, potentially compromising user data and security.

References