Stored Cross-Site Scripting in Flex Guten Plugin for WordPress
CVE-2025-6256
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 August 2025
What is CVE-2025-6256?
The Flex Guten plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate input sanitization and output escaping in the 'thumbnailHoverEffect' parameter. This vulnerability allows authenticated users with Contributor-level access and higher to inject arbitrary scripts into web pages. When these compromised pages are accessed by other users, the malicious scripts can execute, potentially leading to unauthorized actions within the user’s session or sensitive data exposure.
Affected Version(s)
Flex Guten – A Multipurpose Gutenberg Blocks Plugin * <= 1.2.5