Stored Cross-Site Scripting Vulnerability in Markup Markdown Plugin
CVE-2025-9540
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 September 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-9540?
The Markup Markdown WordPress plugin, prior to version 3.20.10, contains a vulnerability that allows links to include JavaScript code. This flaw enables users with contributor roles and higher permissions to execute Stored Cross-Site Scripting (XSS) attacks, potentially compromising the security of the website and its users.
Affected Version(s)
Markup Markdown 0 < 3.20.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.