CVE-2025-1406

CVE-2025-1406 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Newpost Catch plugin for WordPress, affecting all versions up to and including 1.3.19. This flaw stems from insufficient input sanitization and output escaping within the plugin's npc shortcode. An authenticated attacker with contributor-level access or higher can inject malicious web scripts into pages, which will execute when other users view those pages. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 20/100. Currently, there is no evidence of active exploitation, nor is exploit code available on platforms like Metasploit, Nuclei, or ExploitDB. The CVE has also received minimal community discussion and media coverage, which is typical for the majority of reported vulnerabilities.