Stored Cross-Site Scripting Vulnerability in FL3R Accessibility Suite Plugin by WordPress
CVE-2025-6689
5.4MEDIUM
What is CVE-2025-6689?
The FL3R Accessibility Suite plugin for WordPress contains a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in the fl3raccessibilitysuite shortcode. This flaw allows authenticated users, with contributor-level access or higher, to inject malicious scripts into web pages. These scripts are then executed whenever a user accesses a compromised page, posing a significant risk to the integrity of the website.
Affected Version(s)
FL3R Accessibility Suite * <= 1.4
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gilang Asra Bilhadi