CVE-2025-8722

The Content Views plugin for WordPress, up to version 4.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in its Grid and List widgets. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, allowing malicious script injection [1].

To exploit this vulnerability, an attacker must have at least contributor-level access to the WordPress site. By crafting a widget with specially crafted attributes, the attacker can inject arbitrary web scripts that are stored on the server. When any user, including administrators, visits the affected page, the injected script executes in their browser [1].

The impact of successful exploitation includes the execution of arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, defacement, or redirection to malicious sites, potentially compromising the entire WordPress installation [1].

As of the publication date, the vulnerability affects all versions up to and including 4.1. Users are advised to update to the latest patched version of the plugin if available. No workaround has been provided, so updating is the recommended mitigation [1].