{"id":"CVE-2025-15701","kind":"vulnerability","aliases":["CVE-2025-15701"],"related":[],"title":"Easy Social Icons WordPress plugin: stored cross-site scripting from admin settings","description":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.","summary":"The Easy Social Icons WordPress plugin before 4.0.3 outputs some settings on front-end pages without sanitising or escaping them. An administrator can store script in those settings, which runs in visitors' browsers when the unfiltered_html capability is disallowed, such as on a multisite network.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easy-social-icons","multisite","package","wordpress"],"not_affected_if":["single-site-with-unfiltered-html","version-4.0.3-or-later"],"how_to_check":"- Check the installed version of the Easy Social Icons plugin in the WordPress admin under Plugins.\n- Check whether the site is a multisite network where administrators lack the unfiltered_html capability.","fix":"- Easy Social Icons plugin: `4.0.3` or later (per the advisory's 'before 4.0.3' range).","status":"open","published_at":"2026-11-05T06:17:04+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:23+00:00","updated_at":"2026-11-05T06:33:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:23Z","model":"claude-haiku-5-5","output":{"fix":"- Easy Social Icons plugin: `4.0.3` or later (per the advisory's 'before 4.0.3' range).","reach":"network","title":"Easy Social Icons WordPress plugin: stored cross-site scripting from admin settings","impact":"medium","summary":"The Easy Social Icons WordPress plugin before 4.0.3 outputs some settings on front-end pages without sanitising or escaping them. An administrator can store script in those settings, which runs in visitors' browsers when the unfiltered_html capability is disallowed, such as on a multisite network.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","easy-social-icons","multisite"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' browsers, stealing sessions or data","analyst_note":"","how_to_check":"- Check the installed version of the Easy Social Icons plugin in the WordPress admin under Plugins.\n- Check whether the site is a multisite network where administrators lack the unfiltered_html capability.","plain_action":"","needs_analyst":false,"not_affected_if":["version-4.0.3-or-later","single-site-with-unfiltered-html"],"who_is_affected":"Sites running the Easy Social Icons WordPress plugin before 4.0.3, most relevant on multisite networks where administrators do not have unfiltered_html. Exploitation needs an administrator account, so single-site installs where administrators have full HTML rights carry less risk. Sites on 4.0.3 or later are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000716,"input_tokens":4231,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15701':16A,19A '-2025':15A,18A '4.0.3':34B,81C 'admin':12A 'administr':49B,108C 'allow':101C 'attack':116C 'browser':60B 'capabl':65B,121C 'could':100C 'cross':8A,113C 'cross-sit':7A,112C 'cve':14A,17A 'disallow':67B,123C 'easi':1A,21B,28B,75C 'easy-social-icon':20B 'end':41B,97C 'escap':46B,86C 'exampl':125C 'front':40B,96C 'front-end':39B,95C 'high':103C 'high-privileg':102C 'html':64B,120C 'icon':3A,23B,30B,77C 'multisit':24B,72B,128C 'network':73B,129C 'output':35B,92C 'packag':25B 'page':42B,98C 'perform':110C 'plugin':5A,32B,79C 'privileg':104C 'run':57B 'sanitis':44B,84C 'script':10A,52B,115C 'set':13A,37B,55B,90C 'site':9A,114C 'social':2A,22B,29B,76C 'store':6A,51B,111C 'unfilt':63B,119C 'user':105C 'visitor':59B 'without':43B 'wordpress':4A,26B,31B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Easy Social Icons WordPress plugin before 4.0.3, most relevant on multisite networks where administrators do not have unfiltered_html. Exploitation needs an administrator account, so single-site installs where administrators have full HTML rights carry less risk. Sites on 4.0.3 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["easysocialicons","low","multisite","package","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15701","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15701","severity":null,"published_at":"2026-11-05T06:17:04+00:00","modified_at":"2026-11-05T06:17:04+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}