CVE-2025-1561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1561", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-21T16:49:20.221Z", "datePublished": "2025-03-13T04:21:05.201Z", "dateUpdated": "2026-04-08T17:01:40.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:40.382Z"}, "affected": [{"vendor": "scottopolis", "product": "AppPresser \u2013 Mobile App Framework", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.4.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AppPresser \u2013 Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page."}], "title": "AppPresser \u2013 Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77328e35-b6e6-40eb-8c85-896d54419aef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.10/templates/template.php#L32"}, {"url": "https://plugins.trac.wordpress.org/changeset/3254632/apppresser/tags/4.4.11/inc/AppPresser_Log_Admin.php?old=3219464&old_path=apppresser%2Ftags%2F4.4.10%2Finc%2FAppPresser_Log_Admin.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-03-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-17T21:26:18.139339Z", "id": "CVE-2025-1561", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:29:01.895Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1561", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-17T21:26:18.139339Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:26:28.609Z"}}], "cna": {"title": "AppPresser \u2013 Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "scottopolis", "product": "AppPresser \u2013 Mobile App Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.4.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77328e35-b6e6-40eb-8c85-896d54419aef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.10/templates/template.php#L32"}, {"url": "https://plugins.trac.wordpress.org/changeset/3254632/apppresser/tags/4.4.11/inc/AppPresser_Log_Admin.php?old=3219464&old_path=apppresser%2Ftags%2F4.4.10%2Finc%2FAppPresser_Log_Admin.php"}], "descriptions": [{"lang": "en", "value": "The AppPresser \u2013 Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:40.382Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1561", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:40.382Z", "dateReserved": "2025-02-21T16:49:20.221Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-13T04:21:05.201Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AppPresser \u2013 Mobile App Framework", "vendor": "scottopolis", "versions": [{"lessThanOrEqual": "4.4.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apppresser:apppresser:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "DF8BF0BE-8522-4919-AB8E-32B793EE1FEC", "versionEndExcluding": "4.4.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AppPresser \u2013 Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento AppPresser \u2013 Mobile App Framework para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s del par\u00e1metro 'title' en todas las versiones hasta la 4.4.10 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite que atacantes no autenticados inyecten secuencias de comandos web arbitrarias en p\u00e1ginas con el registro habilitado, que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1561", "lastModified": "2026-06-17T08:39:22.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1561", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-17T21:26:18.139339Z", "version": "2.0.3"}}]}, "published": "2025-03-13T05:15:27.890", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.10/templates/template.php#L32"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3254632/apppresser/tags/4.4.11/inc/AppPresser_Log_Admin.php?old=3219464&old_path=apppresser%2Ftags%2F4.4.10%2Finc%2FAppPresser_Log_Admin.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77328e35-b6e6-40eb-8c85-896d54419aef?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:56:20.100229+00:00", "value": {"mitigation_remediation": ["Update AppPresser \u2013 Mobile App Framework to version 4.4.11 or later", "Set logging to disabled or ensure that titles are sanitized before storage", "Review all user interface elements for proper output escaping to prevent future XSS"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "AppPresser \u2013 Mobile App Framework for WordPress \u2013 versions 4.4.10 and earlier are affected. The plugin is a WordPress extension and has been identified as vulnerable by the CNA scottopolis for all releases up to 4.4.10.", "description_and_impact": "This vulnerability allows an attacker to store malicious script code in the \u2018title\u2019 field of the AppPresser \u2013 Mobile App Framework plugin. Because the value is not sanitized or escaped, the injected script is rendered when a page is accessed, causing cross\u2011site scripting in the victim\u2019s browser. The vulnerability is a classic CWE\u201179 flaw and permits unauthenticated users to create or modify content that will run as the logged\u2011in user whenever a logged\u2011in admin or member views the page, compromising confidentiality, integrity, and availability of the web application for those users.", "risk_and_exploitability": "The CVSS score is 7.2, indicating a high severity vulnerability. The EPSS score is below 1\u202f%, meaning the likelihood of exploitation is currently low. The issue is not listed in CISA\u2019s KEV catalog. Per the CVE description, the attack vector requires unauthenticated access to store a malicious title value in the plugin\u2019s logging configuration, after which any authenticated user who views the affected page will execute the injected script. The vulnerability is therefore exploitable in realistic scenarios where logging is enabled and logged pages are viewed by users."}}}}, "created": "2026-04-22T02:00:05.040439+00:00", "updated": "2026-04-22T02:00:05.040466+00:00", "vendors": []}