CVE-2025-0897: Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode
First published: Thu Feb 20 2025(Updated: )
The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Modal Window | <=6.1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/de4dfcc7-fcc0-46e5-8452-98783007368d?source=cve
- https://plugins.trac.wordpress.org/browser/modal-window/trunk/public/class-shortcodes.php#L70
- https://wordpress.org/plugins/modal-window/#developers
- https://plugins.trac.wordpress.org/changeset/3243077/
Frequently Asked Questions
What is the severity of CVE-2025-0897?
CVE-2025-0897 has a high severity rating due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-0897?
To fix CVE-2025-0897, update the Modal Window plugin to the latest version that addresses this vulnerability.
What versions are affected by CVE-2025-0897?
CVE-2025-0897 affects all versions of the Modal Window plugin up to and including version 6.1.5.
What are the potential impacts of CVE-2025-0897?
The potential impacts of CVE-2025-0897 include unauthorized script execution and the possibility of data manipulation on the affected WordPress site.
Is CVE-2025-0897 easy to exploit?
Yes, CVE-2025-0897 can be easily exploited by an attacker familiar with leveraging Stored Cross-Site Scripting vulnerabilities through user input.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/source
- agent/author
- agent/tags
- agent/event
- vendor/wordpress
- canonical/wordpress modal window