CVE-2025-39534: WordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The attack can be initiated remotely without authentication and requires low complexity. Exploitation requires user interaction, meaning a victim must be induced to access attacker-controlled content or a crafted request.

Q: Which installations should be considered affected?

Terms Dictionary versions through 1.5.1 are affected. The available data does not identify a safe fixed version or confirm whether any particular default configuration is required.

Q: What is the potential impact of successful exploitation?

The vulnerability is a reflected XSS issue with low confidentiality, integrity, and availability impact. Because the scope is changed, successful script execution may affect resources beyond the vulnerable plugin's security context.

Published Oct 22, 2025

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1.

Affected Software

2 affected components

Somonator Terms Dictionary<=1.5.1

WordPress Terms Dictionary Plugin<=1.5.1

Event History

Oct 22, 2025

CVE Published

via MITRE·02:32 PM

Data Sourced

via MITRE·02:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack can be initiated remotely without authentication and requires low complexity. Exploitation requires user interaction, meaning a victim must be induced to access attacker-controlled content or a crafted request.

Which installations should be considered affected?

Terms Dictionary versions through 1.5.1 are affected. The available data does not identify a safe fixed version or confirm whether any particular default configuration is required.

What is the potential impact of successful exploitation?

The vulnerability is a reflected XSS issue with low confidentiality, integrity, and availability impact. Because the scope is changed, successful script execution may affect resources beyond the vulnerable plugin's security context.

CVE-2025-39534: WordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations should be considered affected?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations should be considered affected?

What is the potential impact of successful exploitation?