CVE-2025-8046
BaseFortify
Publication date: 2025-08-14
Last updated on: 2025-08-14
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | injection_guard | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Injection Guard WordPress plugin versions before 1.2.8. It occurs because the plugin does not properly escape the $_SERVER['REQUEST_URI'] parameter before outputting it back into an attribute. This flaw can lead to Reflected Cross-Site Scripting (XSS) attacks, particularly in older web browsers.
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute malicious scripts in the context of the affected website by exploiting the unescaped $_SERVER['REQUEST_URI'] parameter. This can lead to unauthorized actions, theft of user data, session hijacking, or other malicious activities when users visit the vulnerable site using old web browsers.