CVE-2025-28957
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This issue affects OwnerRez API: from n/a through <= 1.2.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in OwnerRez API WordPress plugin (<=1.2.1) allows attackers to inject malicious scripts via unsanitized input, affecting site visitors.
Vulnerability
Overview The OwnerRez API plugin for WordPress fails to properly neutralize user input during web page generation, leading to a stored cross-site scripting (XSS) vulnerability. This affects versions from n/a through 1.2.1 [1].
Exploitation
Details Exploitation requires a privileged user (e.g., administrator) to perform an action such as clicking a malicious link or submitting a crafted form. The injected script is stored and executed when other users or visitors access the affected page [1].
Impact
An attacker can inject arbitrary HTML and JavaScript, leading to redirects, advertisements, or other malicious payloads. This could compromise the integrity of the website and affect visitors [1].
Mitigation
The vulnerability is patched in version 1.2.2. Users are advised to update immediately. Patchstack users can enable auto-updates [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.