CVE-2025-23841

WordPress Top Flash Embed plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Jan 16, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foo123 Top Flash Embed top-flash-embed allows Stored XSS.This issue affects Top Flash Embed: from n/a through <= 0.3.4.

Analysis

AI-generated

Technical impact

The Top Flash Embed plugin fails to neutralize user‑supplied content before rendering it in web pages, resulting in a stored cross‑site scripting flaw (CWE‑79). This vulnerability allows malicious JavaScript to be stored through the plugin’s input mechanisms and then executed in the browsers of any visitor to a page that displays that stored content.

Affected Systems

The vulnerability impacts foo123’s Top Flash Embed WordPress plugin, version 0.3.4 and all earlier releases. Sites that have any of these versions installed are susceptible.

Risk and Exploitability

With a CVSS score of 6.5, the flaw poses a moderate severity risk. The EPSS score of <1% indicates a low current probability of exploitation, and the vulnerability is not listed in CISA KEV. Attackers would likely exploit the plugin's data input mechanisms, inserting malicious scripts into stored content that is subsequently rendered for site visitors.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Top Flash Embed to a version that fixes the XSS flaw.
  • Disable the Top Flash Embed plugin or delete all stored content that could contain malicious scripts until a patched version is available.
  • Implement a web application firewall rule that blocks malicious script injections on the plugin’s input forms or in stored content.

Generated by OpenCVE AI on May 2, 2026 at 09:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3469 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikos M. Top Flash Embed allows Stored XSS.This issue affects Top Flash Embed: from n/a through 0.3.4.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikos M. Top Flash Embed allows Stored XSS.This issue affects Top Flash Embed: from n/a through 0.3.4. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foo123 Top Flash Embed top-flash-embed allows Stored XSS.This issue affects Top Flash Embed: from n/a through <= 0.3.4.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikos M. Top Flash Embed allows Stored XSS.This issue affects Top Flash Embed: from n/a through 0.3.4.
Title WordPress Top Flash Embed plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Jan 16, 2025, 11:30 AM

View source JSON

Updated
Jan 17, 2025, 5:17 PM

JSON

Status
Deferred
Published
Jan 16, 2025, 9:15 PM
Modified
Jun 17, 2026, 8:57 AM

View source JSON

No data.

Updated
May 2, 2026, 9:45 AM

JSON