CVE-2025-26766

WordPress Leyka plugin <= 3.31.8 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Feb 16, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue affects Leyka: from n/a through <= 3.31.8.

Analysis

AI-generated

Technical impact

The vulnerability is a stored cross‑site scripting flaw that allows an attacker to embed malicious JavaScript into the Leyka plugin’s data stores, which is then rendered on the website. This defect originates from improper neutralization of input during web page generation. The weakness is identified as CWE‑79.

Affected Systems

The affected product is the VaultDweller Leyka WordPress plugin, all releases up to and including 3.31.8. Users running any of these versions are vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The stored XSS flaw permits an attacker to inject arbitrary JavaScript that will be rendered when the plugin’s content is displayed to users.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Leyka plugin to version 3.31.9 or later to remove the XSS flaw.
  • Implement a stringent Content Security Policy that blocks inline scripts and restricts script sources to trusted domains.
  • Limit administrative access to the Leyka plugin to trusted users or remove the plugin entirely if it cannot be updated safely.

Generated by OpenCVE AI on May 2, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-4239 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka allows Stored XSS. This issue affects Leyka: from n/a through 3.31.8.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka allows Stored XSS. This issue affects Leyka: from n/a through 3.31.8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue affects Leyka: from n/a through <= 3.31.8.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00031}

 epss

{'score': 0.00034}
Type Values Removed Values Added
Metrics epss

{'score': 0.0007}

 epss

{'score': 0.00031}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka allows Stored XSS. This issue affects Leyka: from n/a through 3.31.8.
Title WordPress Leyka plugin <= 3.31.8 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Feb 14, 2025, 6:53 AM

View source JSON

Updated
Feb 18, 2025, 5:24 PM

JSON

Status
Deferred
Published
Feb 16, 2025, 11:15 PM
Modified
Jun 17, 2026, 9:02 AM

View source JSON

No data.

Updated
May 2, 2026, 4:30 AM

JSON