CVE-2025-6256

Vulnerability

Overview

The Flex Guten plugin for WordPress, versions up to and including 1.2.5, contains a stored Cross-Site Scripting (XSS) vulnerability in the 'thumbnailHoverEffect' parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing malicious input to be stored and later rendered unsafely in pages.

Exploitation

Prerequisites

An attacker must be an authenticated WordPress user with at least Contributor-level access. No further privileges are required. The attacker injects arbitrary web scripts into the 'thumbnailHoverEffect' parameter, which are then stored and executed when any user visits the affected page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information. The stored XSS persists until the injected content is removed or the plugin is updated.

Mitigation

The vulnerability has been patched in version 1.2.6 of the plugin, as indicated in the changelog [1]. Users are strongly advised to update to version 1.2.6 or later to eliminate the risk.