PT-2026-137388
CVE-2025-15701
·
Published
2026-11-05
·
Updated
2026-11-05
Description by
CVSS 3.1
3.5
LowMetricsAV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example on a multisite network.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾