Skip to content
Sign in
6.8 Medium

CVE-2025-15690 The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post…

Description

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.

Affected products and versions

Product Affected versions Fixed in
Content Mask 1.7 1.7.1 → < 1.8.5.6 1.8.5.6

Other CVEs of Content Mask

The 3 CVEs of Content Mask →
CVE-2026-77003 The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being… 2.7 Low CVE-2022-1203 The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as… Not rated
Track this CVE