CVE-2025-6550

Опубликовано: 27 июн. 2025

Источник: nvd

CVSS3: 6.4

CVSS3: 5.4

EPSS Низкий

Описание

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:webangon:the_pack_elementor_addons:*:*:*:*:*:wordpress:*:*

Версия до 2.1.3 (включая)

EPSS

Процентиль: 20%

0.00063

Низкий

6.4 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-wv35-2xrj-6w7f

CVSS3: 6.4

github

8 месяцев назад

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

EPSS

Процентиль: 20%

0.00063

Низкий

6.4 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79