Stored Cross-Site Scripting in FancyTabs Plugin for WordPress

CVE-2025-8560

What is CVE-2025-8560?

The FancyTabs plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability that allows authenticated users with Contributor-level access and above to inject malicious web scripts. This occurs through the 'title' parameter due to inadequate input validation and failure to properly escape output. Such vulnerabilities can lead to unauthorized actions and potential data theft when users visit the compromised pages. Users of affected plugin versions should assess their security posture and consider updating to mitigate risks.

References