WordPress Plugin Vulnerabilities

Curator.io < 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The Curator.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
curatorio
Fixed in 1.9.6

References

CVE
CVE-2025-62742
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/101b5012-7f12-4b6d-b9c8-aafb0b9bf039

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Jarno Vos (jarnovos)
Verified
No
WPVDB ID
882b1065-ee4a-465e-bc8e-d808e3548389

Timeline

Publicly Published
2025-12-31 (about 6 months ago)
Added
2026-01-05 (about 6 months ago)
Last Updated
2026-01-27 (about 5 months ago)

Other

Published
Title
Published
2025-01-16
Title
Save & Import Image from URL <= 0.7 - Reflected Cross-Site Scripting
Published
2025-01-18
Title
Age Verification for your checkout page. Verify your customer's identity <= 1.20.0 - Reflected Cross-Site Scripting
Published
2025-01-14
Title
Glossy <= 2.3.5 - Reflected XSS
Published
2026-02-26
Title
Automotive Car Dealership Business WordPress Theme < 13.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields
Published
2026-06-26
Title
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution < 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting