Reflected Cross-Site Scripting Vulnerability in Injection Guard Plugin for WordPress
CVE-2025-8046
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 August 2025
Badges
What is CVE-2025-8046?
The Injection Guard plugin for WordPress versions prior to 1.2.8 is vulnerable to reflected cross-site scripting (XSS) attacks. This vulnerability arises from the plugin's failure to properly escape the '$_SERVER['REQUEST_URI']' parameter before rendering it within HTML attributes. Attackers can exploit this flaw in older web browsers to inject malicious scripts, potentially compromising user data or hijacking sessions. Website owners using this plugin are strongly advised to update to the latest version to mitigate this security risk.
Affected Version(s)
Injection Guard 0 < 1.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.