CVE-2021-25034

PoC —

CVSS 3.1

6.1 medium

EPSS

<1%p55

Published

Feb 28, 2022 (Feb 28, 2022)

Modified

Jun 17, 2026

Description

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues

Vendors: wp user project
Products: wp user
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.