WordPress Plugin Vulnerabilities

VK Filter Search < 2.20.4 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
vk-filter-search
Fixed in 2.20.4

References

CVE
CVE-2025-32175
URL
https://patchstack.com/database/wordpress/plugin/vk-filter-search/vulnerability/wordpress-vk-filter-search-plugin-2-14-1-0-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
zaim
Verified
No
WPVDB ID
c50d29f9-2569-4703-8855-7a9078360176

Timeline

Publicly Published
2025-04-04 (about 1 year ago)
Added
2025-04-09 (about 1 year ago)
Last Updated
2026-08-25 (about 1 month ago)

Other

Published
Title
Published
2025-03-31
Title
AtomChat <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-10-07
Title
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons < 8.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-04-07
Title
Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter
Published
2024-04-30
Title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders < 5.9.18 - Contributor+ Stored XSS
Published
2024-10-17
Title
Add Widget After Content < 2.5 - Admin+ Stored XSS