{"cve":"CVE-2025-15701","enrichment":{"created":"2026-11-05T07:30:14.788208+00:00","updated":"2026-11-05T07:30:14.788214+00:00","vendors":[],"weaknesses":["CWE-79"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:27.863000+00:00","description":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2025/15xxx/CVE-2025-15701.json","references":["https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"],"title":"Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings","updated":"2026-11-05T06:00:27.863000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:04.997000+00:00","description":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2025/CVE-2025-15701.json","references":["https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"],"title":null,"updated":"2026-11-05T06:17:04.997000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.","old":null},"type":"description"},{"details":{"new":"Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"],"removed":[]},"type":"references"}],"id":"c5cb08b2-bd33-473d-908f-58587c410927"},{"created":"2026-11-05T07:45:00+00:00","data":[{"details":{"added":["CWE-79"],"removed":[]},"type":"weaknesses"}],"id":"1eba5aba-f052-4283-b362-74db5fc5aa72"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:27.863000+00:00","provider":"mitre"},"description":{"data":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"],"providers":["mitre","nvd"]},"title":{"data":"Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings","provider":"mitre"},"updated":{"data":"2026-11-05T07:30:14.788214+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-79"],"providers":["enrichment"]}}}