WordPress Plugin Vulnerabilities

Compact Archives < 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The Compact Archives plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
compact-archives
Fixed in 4.1.1

References

CVE
CVE-2025-58001
URL
https://patchstack.com/database/wordpress/plugin/compact-archives/vulnerability/wordpress-compact-archives-plugin-4-1-0-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
theviper17
Verified
No
WPVDB ID
ada6bf92-554e-46cd-a0e9-ddee9d1b982d

Timeline

Publicly Published
2025-09-22 (about 9 months ago)
Added
2025-09-26 (about 9 months ago)
Last Updated
2026-03-05 (about 3 months ago)

Other

Published
Title
Published
2025-01-16
Title
GMap Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-10
Title
Clinked Client Portal <= 1.10 - Reflected Cross-Site Scripting
Published
2026-06-04
Title
WPFunnels Pro < 2.9.5 - Unauthenticated Stored Cross-Site Scripting
Published
2023-10-02
Title
WWM Social Share On Image Hover <= 2.2 - Admin+ Stored XSS
Published
2024-10-31
Title
Bigmart Elements <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting