CVE-2025-5083

Vulnerability

Overview The Amministrazione Trasparente plugin for WordPress (versions up to 9.0) contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings [1]. The issue stems from insufficient input sanitization and output escaping, allowing administrator-level attackers to inject arbitrary web scripts [2][3].

Exploitation

Conditions Exploitation requires authenticated access with administrator-level permissions. The vulnerability is exploitable only on multi-site installations or sites where the unfiltered_html capability has been disabled for administrators [1]. This reduces the attack surface but still affects many configurations.

Impact

Successful exploitation allows an attacker to inject malicious scripts that execute whenever a user accesses an affected page. This can lead to session hijacking, defacement, or theft of sensitive information [1].

Mitigation

The plugin maintainers have not released a patch as of the disclosure date. Users should restrict administrator access, disable unfiltered_html only when necessary, and consider using Web Application Firewall (WAF) rules to block malicious input.