WordPress Plugin Vulnerabilities

Broadstreet < 1.51.3 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
broadstreet
Fixed in 1.51.3

References

CVE
CVE-2025-48113
URL
https://patchstack.com/database/wordpress/plugin/broadstreet/vulnerability/wordpress-broadstreet-1-51-2-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
kmaron1n
Verified
No
WPVDB ID
06f3613b-a906-4de1-b8f6-615e070828ee

Timeline

Publicly Published
2025-05-16 (about 1 year ago)
Added
2025-05-21 (about 1 year ago)
Last Updated
2025-12-09 (about 7 months ago)

Other

Published
Title
Published
2025-10-08
Title
Simple Finance Calculator <= 1.0 - Reflected Cross-Site Scripting
Published
2024-04-10
Title
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 2.6.9 - Contributor+ Stored Cross-Site Scripting via Block Attributes
Published
2021-12-13
Title
Share One Drive < 1.15.3 - Reflected Cross-Site Scripting
Published
2026-01-24
Title
Save as PDF Plugin by PDFCrowd < 4.5.6 - Reflected Cross-Site Scripting via options
Published
2023-02-02
Title
Avalex < 3.0.4 - Admin+ Stored XSS