Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.
Published: 2025-04-01
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an improper neutralization of input during web page generation, enabling attackers to inject arbitrary HTML or JavaScript. The consequence is reflected Cross‑Site Scripting that can execute client‑side code when a victim views a vulnerable page, potentially leading to defacement, credential theft or phishing attacks.

Affected Systems

The vulnerability affects the LeadLab by wiredminds WordPress plugin distributed by wiredmindshelp. All releases from the initial build through version 1.3 are impacted.

Risk and Exploitability

The CVSS score of 7.1 classifies this as high severity. An EPSS score of less than 1 % indicates a low probability of exploitation at this time, and the flaw is not listed in CISA’s KEV catalog. Attackers are likely able to trigger the vulnerability by sending a crafted request to the plugin’s web interface, which reflects untrusted input back to the victim’s browser.

Generated by OpenCVE AI on May 1, 2026 at 01:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the LeadLab by wiredminds plugin to a version later than 1.3 or apply any vendor‑issued security patch.
  • Ensure that all user‑supplied data is validated and properly escaped before being inserted into HTML output.
  • Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted domains.

Generated by OpenCVE AI on May 1, 2026 at 01:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9438 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds allows Reflected XSS. This issue affects LeadLab by wiredminds: from n/a through 1.3.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds allows Reflected XSS. This issue affects LeadLab by wiredminds: from n/a through 1.3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 02 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Apr 2025 21:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds allows Reflected XSS. This issue affects LeadLab by wiredminds: from n/a through 1.3.
Title WordPress LeadLab by wiredminds plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:09.080Z

Reserved: 2025-03-31T10:05:43.539Z

Link: CVE-2025-31568

cve-icon Vulnrichment

Updated: 2025-04-02T13:19:48.647Z

cve-icon NVD

Status : Deferred

Published: 2025-04-01T21:15:50.640

Modified: 2026-04-23T15:27:58.910

Link: CVE-2025-31568

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T01:30:05Z

Weaknesses