CVE-2025-23816: WordPress Metaphor Widgets plugin <= 2.4 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets mtphr-widgets allows Stored XSS.This issue affects Metaphor Widgets: from n/a through <= 2.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23816?
CVE-2025-23816 has a high severity rating due to its potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-23816?
To fix CVE-2025-23816, you should update Metaphor Widgets to version 2.5 or later.
Which versions of Metaphor Widgets are affected by CVE-2025-23816?
CVE-2025-23816 affects all versions of Metaphor Widgets from n/a up to and including version 2.4.
What type of vulnerability is CVE-2025-23816?
CVE-2025-23816 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
Can CVE-2025-23816 be exploited remotely?
Yes, CVE-2025-23816 can be exploited remotely, allowing attackers to execute scripts in the context of an affected user.