Stored Cross-Site Scripting in Google Drive Plugin for WordPress
CVE-2025-7050
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 August 2025
What is CVE-2025-7050?
The Use-your-Drive | Google Drive plugin for WordPress has a vulnerability that allows attackers to exploit the 'title' parameter in file metadata. This issue arises from inadequate input sanitization and output escaping, enabling the injection of arbitrary web scripts that execute when a user accesses the compromised page. Notably, even the lowest authentication level permitted for file uploads, including unauthenticated users, can exploit this vulnerability once a file upload shortcode is publicly visible.
Affected Version(s)
Use-your-Drive | Google Drive plugin for WordPress * <= 3.3.1