CVE-2025-52754: WordPress Sello ChannelConnector plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Q: Does exploiting this issue require authentication or interaction from another user?

No privileges are required by the attacker, but exploitation requires user interaction. The attack can be carried out over the network with low attack complexity.

Q: Which installations are affected?

Sello ChannelConnector versions through 1.6.3 are affected. The available data does not identify a fixed version or any workaround for installations that cannot be updated.

Published Oct 22, 2025

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in selloio Sello ChannelConnector sello-channelconnector allows Reflected XSS.This issue affects Sello ChannelConnector: from n/a through <= 1.6.3.

Affected Software

2 affected components

Sello ChannelConnector<=1.6.3

WordPress Sello ChannelConnector<=1.6.3

Event History

Oct 22, 2025

CVE Published

via MITRE·02:32 PM

Data Sourced

via MITRE·02:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploiting this issue require authentication or interaction from another user?

No privileges are required by the attacker, but exploitation requires user interaction. The attack can be carried out over the network with low attack complexity.

Which installations are affected?

Sello ChannelConnector versions through 1.6.3 are affected. The available data does not identify a fixed version or any workaround for installations that cannot be updated.

CVE-2025-52754: WordPress Sello ChannelConnector plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploiting this issue require authentication or interaction from another user?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploiting this issue require authentication or interaction from another user?

Which installations are affected?