CVE-2025-49318

WordPress WPtouch plugin <= 4.3.60 - Cross Site Scripting (XSS) Vulnerability

View on CVE.org
Published Jun 6, 2025 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affects WPtouch: from n/a through <= 4.3.60.

Analysis

AI-generated

Technical impact

The vulnerability is an improper neutralization of input during web page generation that allows an attacker to inject arbitrary JavaScript. This stored XSS can be persisted in the WPtouch plugin and then served to any user who views the affected content, potentially enabling session hijacking, defacement or data theft.

Affected Systems

The WPtouch plug‑in for WordPress, any installed version up to and including 4.3.60, is affected.

Risk and Exploitability

The CVSS score of 5.9 indicates a medium impact. The EPSS score of < 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated or, if the plugin renders user‑supplied content, an unauthenticated attacker injecting malicious script through the plugin’s input fields, with the code then executed when other site visitors load the page.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WPtouch plug‑in to a supported version greater than 4.3.60.
  • Sanitize all input that is stored or displayed by the plug‑in, or disable the feature that allows arbitrary script entry.
  • Conduct a security scan to detect and remove any persisted XSS payloads from the database.

Generated by OpenCVE AI on April 30, 2026 at 11:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-17252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch allows Stored XSS. This issue affects WPtouch: from n/a through 4.3.60.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch allows Stored XSS. This issue affects WPtouch: from n/a through 4.3.60. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affects WPtouch: from n/a through <= 4.3.60.
Title WordPress WPtouch <= 4.3.60 - Cross Site Scripting (XSS) Vulnerability WordPress WPtouch plugin <= 4.3.60 - Cross Site Scripting (XSS) Vulnerability
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch allows Stored XSS. This issue affects WPtouch: from n/a through 4.3.60.
Title WordPress WPtouch <= 4.3.60 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 12, 2026, 12:22 AM
Reserved
Jun 4, 2025, 9:42 AM

View source JSON

Updated
Jun 6, 2025, 6:58 PM

JSON

Status
Deferred
Published
Jun 6, 2025, 1:15 PM
Modified
Jun 17, 2026, 9:31 AM

View source JSON

No data.

Updated
Apr 30, 2026, 12:00 PM

JSON