Cross-site Scripting Vulnerability in xili-tidy-tags Plugin by Michel

CVE-2025-58240

What is CVE-2025-58240?

The xili-tidy-tags plugin by Michel is susceptible to an improper neutralization of input during web page generation, leading to a Stored XSS vulnerability. This flaw allows attackers to inject malicious scripts into web pages viewed by users. The exploitation of this vulnerability can enable cybercriminals to execute arbitrary JavaScript in the context of a user's session, resulting in data theft or manipulation. It impacts all versions starting from n/a up to 1.12.06, highlighting the need for WordPress site administrators to update to a patched version to mitigate exposure.

References