WordPress Plugin Vulnerabilities

Archive Page < 1.0.3 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
archive-page
Fixed in 1.0.3

References

CVE
CVE-2025-27280
URL
https://patchstack.com/database/wordpress/plugin/archive-page/vulnerability/wordpress-archive-page-plugin-1-0-1-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
yudha
Verified
No
WPVDB ID
b868fbbd-cca3-4f37-af59-e873c58850be

Timeline

Publicly Published
2025-02-24 (about 1 year ago)
Added
2025-03-03 (about 1 year ago)
Last Updated
2025-04-17 (about 1 year ago)

Other

Published
Title
Published
2021-10-14
Title
Job Manager <= 0.7.25 - Admin+ Stored Cross-Site Scripting
Published
2025-11-14
Title
Stylish Cost Calculator < 8.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-03-10
Title
Astra < 4.12.4 - Contributor+ Stored XSS via Post Meta
Published
2024-06-26
Title
Portfolio Gallery – Image Gallery Plugin < 1.6.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published
2024-04-16
Title
WP-Lister Lite for eBay < 3.6.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting