CVE Daily

CVE-2025-36548

A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginFor...

High CVSS 8.3

Overview

A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

CWE: CWE-79 Published: 2025-07-24T16:15:31.117
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 8.3 (HIGH)
  • Detected tags: xss (tag impact: MODERATE)

Recommended actions:

  • Apply context-aware output encoding.
  • Enable Content-Security-Policy and HttpOnly/SameSite cookies.

Recommended tools

Tags