Stored Cross-Site Scripting Vulnerability in Planetcalc Plugin for WordPress

CVE-2025-8777

What is CVE-2025-8777?

The Planetcalc plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'language' parameter, affecting all versions up to 2.2. This is primarily due to inadequate input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can exploit this flaw to inject arbitrary web scripts into pages. These scripts will execute whenever any user accesses the compromised page, posing significant security risks.

References