CVE-2025-1033

The CVE-2025-1033 entry concerns the Badgearoo WordPress plugin (versions up to 1.0.14). The root cause is insufficient sanitisation/escaping of certain plugin settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Publ...