Stored Cross-Site Scripting in Epic Bootstrap Buttons for WordPress

CVE-2025-8776

What is CVE-2025-8776?

The Epic Bootstrap Buttons plugin for WordPress exhibits a vulnerability to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping via the 'icol' parameter. This flaw allows authenticated users with Contributor-level access or greater to inject malicious web scripts into pages. These scripts will execute automatically when another user accesses an affected page, potentially compromising user sessions or leading to further exploitation.

References