6.4 Moyenne

CVE-2025-10192 The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect'…

Description

The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
WP Photo Effects 1.2	premières → 1.2.4	Pas de correctif indiqué

Les 2 CVE de WP Photo Effects →

CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Moyenne

Vous utilisez WP Photo Effects ?

Suivre cette CVE Surveiller WP Photo Effects Vérifier mes SBOM

www.cveye.io/fr/cve/CVE-2025-10192

Chronologie

Publiée 3 octobre 2025
Dernière modification 8 avril 2026

Références

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
wordpress.org wordpress.org

Suivre cette CVE

CVE-2025-10192 The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect'…

Description

Produits et versions touchés

Autres CVE de WP Photo Effects