CVE-2025-1523

The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Ultimate Dashboard plugin < 3.8.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Ultimate Dashboard versions 3.8.6...

CVE-2025-1523

creationtimestamp| type| source ---|---|--- 2025-04-17 06:48:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmyj7hk4ms2h 2025-04-17 06:57:16+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12196 2025-04-17 10:28:12+00:00| seen| https://t.me/cvedetector/23218...

CVE-2025-1523

The Ultimate Dashboard WordPress plugin (versions prior to 3.8.6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS atta...