CVE-2025-62963: WordPress Estatik plugin <= 4.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.0.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62963?
CVE-2025-62963 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-62963?
To fix CVE-2025-62963, upgrade to Estatik version 4.1.14 or later.
What does CVE-2025-62963 affect?
CVE-2025-62963 affects Estatik versions up to and including 4.1.13.
What type of vulnerability is CVE-2025-62963?
CVE-2025-62963 is an improper neutralization of input during web page generation, leading to DOM-based cross-site scripting.
Who is affected by CVE-2025-62963?
Users running the Estatik plugin for WordPress versions up to 4.1.13 are affected by CVE-2025-62963.