WordPress Easy 3D Viewer plugin <= 1.8.6.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library vulnerability

🗓️ 31 Dec 2025 00:00:00Reported by WebbernautType

Authenticated contributor can trigger stored DOM-based XSS in WordPress Easy 3D Viewer <=1.8.6.6 via prettyPhoto.

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress多款产品跨站脚本漏洞	3 Jul 202500:00	–	cnnvd
CVE	CVE-2025-2540	3 Jul 202511:19	–	cve
Cvelist	CVE-2025-2540 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library	3 Jul 202511:19	–	cvelist
EUVD	EUVD-2025-19857	3 Oct 202520:07	–	euvd
NVD	CVE-2025-2540	3 Jul 202512:15	–	nvd
Patchstack	WordPress WP Video Lightbox plugin <= 1.9.11 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library vulnerability	31 Dec 202500:00	–	patchstack
Patchstack	WordPress Easy Image Gallery plugin <= 1.5.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library vulnerability	31 Dec 202500:00	–	patchstack
Positive Technologies	PT-2025-27775 · Unknown +1 · Prettyphoto +1	3 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-2540	5 Jul 202511:22	–	redhatcve
Vulnrichment	CVE-2025-2540 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library	3 Jul 202511:19	–	vulnrichment

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/detail/multiple-plugins-various-versions-authenticated-contributor-stored-dom-based-cross-site-scripting-via-prettyphoto-javascript-library

31 Dec 2025 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.4

EPSS0.00451

SSVC