CVE-2025-1406

The CVE-2025-1406 entry concerns the Newpost Catch WordPress plugin. It is vulnerable to Stored Cross-Site Scripting via the npc shortcode in all versions up to 1.3.19, caused by insufficient input sanitization and output escaping for user-supplied attributes. The impact is that an authenticated ...