---
id: "CVE-2025-15701"
kind: "vulnerability"
aliases: ["CVE-2025-15701"]
title: "Easy Social Icons WordPress plugin: stored cross-site scripting from admin settings"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["easy-social-icons", "multisite", "package", "wordpress"]
not_affected_if: ["single-site-with-unfiltered-html", "version-4.0.3-or-later"]
published_at: "2026-11-05T06:17:04+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:33:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15701", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# Easy Social Icons WordPress plugin: stored cross-site scripting from admin settings

The Easy Social Icons WordPress plugin before 4.0.3 outputs some settings on front-end pages without sanitising or escaping them. An administrator can store script in those settings, which runs in visitors' browsers when the unfiltered_html capability is disallowed, such as on a multisite network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Easy Social Icons plugin in the WordPress admin under Plugins.
- Check whether the site is a multisite network where administrators lack the unfiltered_html capability.

## Fix

- Easy Social Icons plugin: `4.0.3` or later (per the advisory's 'before 4.0.3' range).

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-15701

## From the sources

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_