WordPress Plugin Vulnerabilities

VOD Infomaniak < 1.5.12 - Unauthenticated Stored Cross-Site Scripting

Description

The VOD Infomaniak plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
vod-infomaniak
Fixed in 1.5.12

References

CVE
CVE-2025-62020
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/481be4ab-f8df-4080-b87b-24e4d40f83b1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
No
WPVDB ID
44df363d-0b50-45b7-a030-1b3cda68cc98

Timeline

Publicly Published
2025-09-23 (about 7 months ago)
Added
2025-10-29 (about 6 months ago)
Last Updated
2025-10-29 (about 6 months ago)

Other

Published
Title
Published
2024-05-07
Title
HT Mega – Absolute Addons For Elementor < 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify
Published
2025-08-03
Title
JetElements For Elementor < 2.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2015-08-13
Title
All In One WP Security & Firewall <= 3.9.7 - Unauthenticated Cross-Site Scripting (XSS)
Published
2014-08-01
Title
Broken Link Checker 1.9.1 - Sort Direction Query Argument H&ling XSS
Published
2024-03-16
Title
Smart Online Order for Clover < 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting