Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2025-1452: Favorites WordPress plugin before 2.3.5 allows administrative takeover
CVE-2025-1452 · published 1 year ago
Summary
If an attacker with administrative access to a WordPress site uses this plugin, they could potentially take control of the site, making changes and executing malicious code. This is a concern for any site using this plugin, especially if it has multiple administrators. Update the plugin to version 2.3.5 or later to fix this issue.
What to do
- Update favoriteposts favorites to version 2.3.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| favoriteposts | favorites |
< 2.3.5 cpe:2.3:a:favoriteposts:favorites:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks ev...
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
References
- https://wpscan.com/vulnerability/47365daf-7ef5-471a-ab0e-f6d1b40ca56c/ Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published25 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-1452 · NVD
Track software like this
Free during beta