CVE-2025-25108
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through <= 2.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Reflected XSS vulnerability in SW Plus WordPress plugin allows attackers to inject malicious scripts via crafted requests, requiring user interaction.
The SW Plus plugin for WordPress (shalom-world-media-gallery) versions up to 2.1 contain a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript code into the application's response.
Exploitation requires a privileged user to perform an action, such as clicking a malicious link, visiting a crafted page, or submitting a form. Attackers can leverage this in mass-exploit campaigns targeting thousands of websites regardless of size or popularity [1].
Successful exploitation could allow an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads, which execute when other users visit the affected site [1].
Users are advised to update the plugin immediately. For those unable to update, Patchstack offers a mitigation rule to block attacks until an official patch is available [1].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <= 2.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.