WordPress Plugin Vulnerabilities

Estatik <= 4.3.5 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
estatik
No known fix

References

CVE
CVE-2025-62963
URL
https://patchstack.com/database/wordpress/plugin/estatik/vulnerability/wordpress-estatik-plugin-4-1-13-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Peter Thaleikis
Verified
No
WPVDB ID
0abd8b09-7641-4ea4-b549-688d6eaddc12

Timeline

Publicly Published
2025-10-16 (about 11 months ago)
Added
2025-10-29 (about 10 months ago)
Last Updated
2026-09-12 (about 9 days ago)

Other

Published
Title
Published
2024-03-18
Title
WPB Show Core < 2.6 - Reflected XSS
Published
2025-07-16
Title
JetTricks < 1.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-07
Title
Logo Slider < 4.5.0 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2014-09-29
Title
My Calendar 1.10.2 - XSS in PATH_INFO Parameter
Published
2023-01-04
Title
Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.3 - Contributor+ Stored XSS via Shortcode