CVE-2025-15701

Full vulnerability record from the local CVENow database.

Description

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 06:17:04.997000

Last modified

2026-11-05 06:17:04.997000

View original CVE JSON

{
  "id": "CVE-2025-15701",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T06:17:04.997",
  "lastModified": "2026-11-05T06:17:04.997",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Easy Social Icons",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.0.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/",
      "source": "[email protected]"
    }
  ]
}