CVE-2025-8316

Name of the Vulnerable Software and Affected Versions Certifica WP versions prior to 3.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the evento parameter, which then execute when a user visits the affected page.

Recommendations Update the plugin to version 3.2 or later. As a temporary mitigation, restrict access to the evento parameter for users with Contributor-level permissions.