Cross-site Scripting Vulnerability in Spiffy Plugins WP Flow Plus
CVE-2025-58625

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Flow Plus
Vendor
CVE Published:
3 September 2025

What is CVE-2025-58625?

The Spiffy Plugins WP Flow Plus is susceptible to a Cross-site Scripting (XSS) vulnerability, enabling attackers to exploit improper input neutralization during web page generation. This vulnerability allows for the storage of malicious scripts within the application, which can be executed in the context of a user's session. Affected versions include those prior to 5.2.5, leaving users at risk of compromised security and potentially exposing sensitive information.

Affected Version(s)

WP Flow Plus <= 5.2.5

References

https://patchstack.com/database/wordpress/plugin/wp-image...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
.
CVE-2025-58625 : Cross-site Scripting Vulnerability in Spiffy Plugins WP Flow Plus