{"id":"CVE-2025-15701","title":"Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings","summary":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site S…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-79"],"product":"Easy Social Icons","affected":["easy_social_icons < 4.0.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T11:55:58.323416Z"},"published":"2026-11-05","updated":"2026-11-06","sourceUpdated":"2026-11-06T12:08:59.917Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-15701","references":[{"url":"https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"}],"tags":["cve.org"],"epss":0.00153,"epssPercentile":0.04459,"ingestedAt":"2026-11-05T21:36:00.786Z","slug":"CVE-2025-15701","body":"## Overview\n\nThe Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.\n\n## Affected\n\n- `easy_social_icons < 4.0.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":235042,"id":"CVE-2025-15701","ts":1793969518078,"field":"cvss","old":null,"new":"3.5"},{"seq":235041,"id":"CVE-2025-15701","ts":1793969518078,"field":"severity","old":"none","new":"low"}]}