The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/b84a73a4-7e9b-4994-a9bb-ad47f7cf45da/ | Exploit Third Party Advisory |
Configurations
History
02 Jul 2025, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Amauri tarteaucitron.io
Amauri |
|
| CPE | cpe:2.3:a:amauri:tarteaucitron.io:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/b84a73a4-7e9b-4994-a9bb-ad47f7cf45da/ - Exploit, Third Party Advisory | |
| CWE | CWE-79 |
18 Jun 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-18 06:15
Updated : 2025-07-02 19:25
NVD link : CVE-2025-4955
Mitre link : CVE-2025-4955
JSON object : View
Products Affected
amauri
- tarteaucitron.io
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')