The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and including, 1.2.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
| Link | Resource |
|---|---|
| https://wordpress.org/plugins/namasha-by-mdesign/#developers | Product Release Notes |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7616d0-7b42-4b2e-8378-18c24c7bf22b?source=cve | Third Party Advisory |
Configurations
History
08 Jul 2025, 11:34
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
07 Jul 2025, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wordpress.org/plugins/namasha-by-mdesign/#developers - Product, Release Notes | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7616d0-7b42-4b2e-8378-18c24c7bf22b?source=cve - Third Party Advisory | |
| CPE | cpe:2.3:a:mdezign:namasha:*:*:*:*:*:wordpress:*:* | |
| First Time |
Mdezign
Mdezign namasha |
26 Jun 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-26 03:15
Updated : 2025-07-08 11:34
NVD link : CVE-2025-6537
Mitre link : CVE-2025-6537
JSON object : View
Products Affected
mdezign
- namasha
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')