CVE-2025-23909

WordPress Compare Ninja plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Jan 16, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja compare-ninja-comparison-tables allows Stored XSS.This issue affects Compare Ninja: from n/a through <= 2.1.0.

Analysis

AI-generated

Technical impact

The vulnerability is an improper neutralization of input during web page generation (CWE-79). The Compare Ninja plugin stores malicious script code when input is not adequately sanitized, allowing an attacker to inject scripts that execute in the browsers of visitors who view the affected content. This can lead to session hijacking, data theft, or defacement of the site.

Affected Systems

The vulnerability affects the Common Ninja Compare Ninja plugin for WordPress, with all releases up to and including version 2.1.0 exposed to risk.

Risk and Exploitability

The CVSS score of 6.5 reflects a moderate severity, while the EPSS score of less than 1% suggests low exploitation probability in the short term. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would likely target the plugin’s administration or content‑creation interfaces to submit malicious payloads that are later rendered on the front‑end, making the stored XSS attractive to attackers with knowledge of the site’s plugin usage.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Compare Ninja plugin from any version ≤ 2.1.0 to the latest release that contains the XSS fix.
  • Scan for and remove or sanitize any stored content that may contain injected scripts, then delete or update the affected entries.
  • Disable or uninstall the plugin if it is not required for the site’s functionality.

Generated by OpenCVE AI on May 1, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3524 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja allows Stored XSS.This issue affects Compare Ninja: from n/a through 2.1.0.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja allows Stored XSS.This issue affects Compare Ninja: from n/a through 2.1.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja compare-ninja-comparison-tables allows Stored XSS.This issue affects Compare Ninja: from n/a through <= 2.1.0.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja allows Stored XSS.This issue affects Compare Ninja: from n/a through 2.1.0.
Title WordPress Compare Ninja plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Jan 16, 2025, 11:32 AM

View source JSON

Updated
Jan 17, 2025, 5:16 PM

JSON

Status
Deferred
Published
Jan 16, 2025, 9:15 PM
Modified
Jun 17, 2026, 8:57 AM

View source JSON

No data.

Updated
May 1, 2026, 8:30 PM

JSON