PT-2026-7492
CVE-2025-15440
·
Published
2026-02-10
·
Updated
2026-02-16
Description by
CVSS 3.1
7.2
HighMetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
iONE360 Configurator plugin for WordPress versions through 2.0.57
Description
The iONE360 Configurator plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in the Contact Form Parameters. An unauthenticated attacker can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.
Recommendations
Update iONE360 Configurator plugin for WordPress to a version later than 2.0.57.
Found an issue in the description? Have something to add? Feel free to write us 👾