CVE-2025-5686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5686", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-04T14:00:17.495Z", "datePublished": "2025-06-06T06:42:55.081Z", "dateUpdated": "2026-04-08T17:34:47.118Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:47.118Z"}, "affected": [{"vendor": "andreyk", "product": "Paged Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Paged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7dbdbe-fd0f-404b-9f9f-06e942f60a73?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paged-gallery/trunk/paged-gallery.php#L64"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "cweId": "CWE-80", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-06-05T17:58:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-06T15:42:00.921423Z", "id": "CVE-2025-5686", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T16:08:15.547Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5686", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-06T15:42:00.921423Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T15:42:02.774Z"}}], "cna": {"title": "Paged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "andreyk", "product": "Paged Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-05T17:58:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7dbdbe-fd0f-404b-9f9f-06e942f60a73?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paged-gallery/trunk/paged-gallery.php#L64"}], "descriptions": [{"lang": "en", "value": "The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:47.118Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5686", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:47.118Z", "dateReserved": "2025-06-04T14:00:17.495Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-06T06:42:55.081Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Paged Gallery", "vendor": "andreyk", "versions": [{"lessThanOrEqual": "0.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Paged Gallery para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode \"gallery\" en todas las versiones hasta la 0.7 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5686", "lastModified": "2026-06-17T09:48:33.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5686", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-06T15:42:00.921423Z", "version": "2.0.3"}}]}, "published": "2025-06-06T07:15:30.070", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paged-gallery/trunk/paged-gallery.php#L64"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7dbdbe-fd0f-404b-9f9f-06e942f60a73?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:35:22.722929+00:00", "value": {"mitigation_remediation": ["Upgrade the Paged Gallery plugin to the latest available version that removes the XSS vulnerability, or uninstall the plugin if it is no longer needed.", "If an immediate upgrade is not feasible, restrict Contributor and higher role access to content creation functions, or temporarily replace the gallery shortcode with a safe alternative.", "After applying the fix, validate that the gallery shortcode no longer outputs unsanitized attributes by testing on a staging environment before deploying to production."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in all releases of the Paged Gallery plugin up to and including version 0.7. Users who have installed any of these versions on a WordPress site are affected. No other products or versions are listed as impacted.", "description_and_impact": "The Paged Gallery plugin for WordPress is affected by a stored Cross\u2011Site Scripting flaw that can be triggered through the plugin\u2019s gallery shortcode. The flaw originates from insufficient input sanitization and output escaping on user\u2011supplied attributes, enabling attackers to embed malicious scripts. Consequently, whenever a page containing the injected shortcode is viewed, the injected scripts execute in the browsers of all users who access the page.", "risk_and_exploitability": "The CVSS base score of 6.4 reflects a moderate severity XSS risk. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not catalogued in CISA\u2019s KEV. Attackers must first authenticate to the WordPress site with a Contributor role or higher, then supply the malicious attributes via the shortcode. Because the flaw is stored, the attack requires only a single authenticated visit to embed the payload; subsequent unauthenticated visitors to the affected page will experience the injected scripts."}}}}, "created": "2026-04-20T22:45:20.540447+00:00", "updated": "2026-04-20T22:45:20.540456+00:00", "vendors": []}