Stored Cross-Site Scripting Vulnerability in Certifica WP Plugin for WordPress
CVE-2025-8316

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Certifica WP
Vendor
CVE Published:
11 September 2025

What is CVE-2025-8316?

The Certifica WP plugin for WordPress has a vulnerability that allows authenticated contributors and above to exploit the 'evento' parameter. This issue arises from inadequate input sanitization and output escaping, making it possible for attackers to inject malicious web scripts. When users access pages where these scripts are injected, they may unknowingly execute harmful actions. As a result, the security integrity of affected WordPress sites can be severely compromised.

Affected Version(s)

Certifica WP * <= 3.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/certifica-wp/tags/3.1/c...
https://wordpress.org/plugins/certifica-wp/#developers

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ
.
CVE-2025-8316 : Stored Cross-Site Scripting Vulnerability in Certifica WP Plugin for WordPress