Stored Cross-Site Scripting Vulnerability in Interactive Human Anatomy Plugin for WordPress

CVE-2025-9332

What is CVE-2025-9332?

The Interactive Human Anatomy plugin for WordPress suffers from a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping in its admin settings. This flaw allows authenticated users with administrator-level permissions to inject arbitrary scripts within pages, which can then execute when other users access the affected pages. This vulnerability primarily impacts multi-site WordPress installations and configurations where unfiltered_html capability is disabled, potentially leading to significant security risks for user data and site integrity.

References