Stored Cross-Site Scripting Vulnerability in isMobile Plugin for WordPress
CVE-2025-6488
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 June 2025
What is CVE-2025-6488?
The isMobile plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'device' parameter in all versions up to 1.1.1. This vulnerability arises from a lack of adequate input sanitization and output escaping, enabling authenticated users with Contributor-level access and above to inject arbitrary web scripts. These scripts will execute each time a user accesses the compromised pages, leading to potential exploitation and data exposure.
Affected Version(s)
isMobile() Shortcode for WordPress * <= 1.1.1