CVE-2025-22676: WordPress Upcasted S3 Offload plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-s3-offload allows Stored XSS.This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through <= 3.0.3.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22676?
CVE-2025-22676 is a critical vulnerability due to its ability to allow stored Cross-site Scripting (XSS).
How do I fix CVE-2025-22676?
To fix CVE-2025-22676, update the Upcasted AWS S3 for WordPress Plugin to version 3.0.4 or later.
What versions are affected by CVE-2025-22676?
CVE-2025-22676 affects all versions of the Upcasted AWS S3 for WordPress Plugin up to 3.0.3.
What can happen if CVE-2025-22676 is exploited?
If exploited, CVE-2025-22676 can lead to unauthorized access and data theft through stored XSS attacks.
Is there a workaround for CVE-2025-22676?
There is no known workaround for CVE-2025-22676; updating to the fixed version is strongly recommended.