Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-23513: Bible Embed up to 0.0.4 lets attackers run scripts

CVE-2025-23513 · published 1 year ago

Summary

The Bible Embed plugin (versions up to 0.0.4) can be tricked into executing malicious code in a user's web browser. This happens because the plugin does not properly verify requests, allowing attackers to embed harmful scripts that run when users view the page. Update the plugin to the latest safe version or disable it until it is patched, and ensure that any user‑generated content is properly filtered.

Original advisory text

Cross-Site Request Forgery (CSRF) vulnerability in jd7777 Bible Embed bible-embed allows Stored XSS.This issue affects Bible Embed: from n/a through <= 0.0.4.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published16 Jan 2025

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-23513 · NVD

Track software like this

Free during beta