Stored Cross-Site Scripting Vulnerability in Markup Markdown Plugin by WordPress
CVE-2025-9541
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 September 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-9541?
The Markup Markdown WordPress plugin prior to version 3.20.10 has a vulnerability that permits the inclusion of JavaScript within links. This flaw enables users with contributor privileges and higher to exploit the system by executing Stored Cross-Site Scripting attacks, potentially leading to unauthorized actions or data exposure.
Affected Version(s)
Markup Markdown 0 < 3.20.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.