Broadstreet < 1.51.8 – Reflected XSS | CVE 2025-4652 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

Make a logged in admin open the below URL:

http://example.com/wp-content/plugins/broadstreet/Broadstreet/Vendor/broadstreet-partner/index.php?action=register&id=123&next="/><script>alert(1)</script>

Affects Plugins

Fixed in 1.51.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Tommaso Gregori (p1s1o)

Submitter

Tommaso Gregori (p1s1o)

Submitter website

https://linkedin.com/in/tommasogregori

Verified

Yes

WPVDB ID

2a18ab96-ba95-4599-824f-df12e4851e6d

Timeline

Publicly Published

2025-05-19 (about 7 months ago)

Added

2025-05-19 (about 7 months ago)

Last Updated

2025-05-19 (about 7 months ago)

Other

Published

Title

Published

2023-07-17

Title

WPBulky < 1.0.10 - Contributor+ Stored Cross-Site Scripting

Published

2025-01-10

Title

Google Map Professional <= 1.0 - Reflected XSS

Published

2024-11-04

Title

CF7 WOW Styler < 1.6.9 - Reflected Cross-Site Scripting

Published

2024-03-22

Title

Page Builder by SiteOrigin < 2.29.7 - Contributor+ Stored XSS

Published

2025-01-29

Title

Stratum – Elementor Widgets < 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget