Stored Cross-Site Scripting in Flex Guten Plugin for WordPress

CVE-2025-6256

What is CVE-2025-6256?

The Flex Guten plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate input sanitization and output escaping in the 'thumbnailHoverEffect' parameter. This vulnerability allows authenticated users with Contributor-level access and higher to inject arbitrary scripts into web pages. When these compromised pages are accessed by other users, the malicious scripts can execute, potentially leading to unauthorized actions within the user’s session or sensitive data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References