WordPress Category Posts Widget plugin < 4.9.20 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.20...

CVE-2025-1453

creationtimestamp| type| source ---|---|--- 2025-04-24 06:05:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13191 2025-04-24 08:52:54+00:00| seen| https://t.me/cvedetector/23641 2025-04-24 09:15:11+00:00| seen|...

CVE-2025-1453

The Category Posts Widget WordPress plugin versions prior to 4.9.20 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This risk persi...