Cross-site Scripting Vulnerability in Simple Link List Widget by Jimmywb
CVE-2025-58810

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Link List Widget
Vendor
CVE Published:
5 September 2025

What is CVE-2025-58810?

The Simple Link List Widget developed by Jimmywb is prone to a Stored Cross-site Scripting (XSS) vulnerability, which allows attackers to inject malicious scripts that can be executed in the web browsers of users interacting with the affected widget. This flaw exists due to improper input sanitization during web page generation. Attackers can exploit this vulnerability to execute arbitrary JavaScript code, potentially compromising user session data and sensitive information.

Affected Version(s)

Simple Link List Widget <= 0.3.2

References

https://patchstack.com/database/wordpress/plugin/simple-l...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Que Thanh Tuan - Blue Rock (Patchstack Alliance)
.