Cross-site Scripting in NPS Computy by Calliko
CVE-2025-67984

7.1HIGH

Key Information:

Vendor

WordPress
Status
Nps Computy
Vendor
CVE Published:
20 February 2026

What is CVE-2025-67984?

A Cross-site Scripting (XSS) vulnerability has been identified in NPS Computy, a product offered by Calliko, allowing attackers to inject malicious scripts into web pages viewed by users. This flaw, which occurs due to improper neutralization of input during web page generation, exposes users to potential exploitation, especially when versions up to 2.8.2 are in use. It is crucial for organizations using NPS Computy to implement updates and security measures to protect against this risk.

Affected Version(s)

NPS computy 0 <= 2.8.2

References

https://patchstack.com/database/Wordpress/Plugin/nps-comp...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Skalucy | Patchstack Bug Bounty Program
.