CVE-2025-15483

Name of the Vulnerable Software and Affected Versions Link Hopper plugin for WordPress versions up to and including 2.5

Description The Link Hopper plugin for WordPress is susceptible to Stored Cross-Site Scripting through the hop name parameter. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update the Link Hopper plugin to a version newer than 2.5.