PT-2026-1722 · WordPress · Top Position Google Finance

Abdulsamad Yusuf · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2025-13895

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Top Position Google Finance versions up to and including 0.1.0

Description The Top Position Google Finance plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which can execute if a user is tricked into performing an action, such as clicking a link. The vulnerability is related to the $ SERVER['PHP SELF'] variable.

Recommendations Update Top Position Google Finance to a version newer than 0.1.0.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-13895

Produtos afetados

Top Position Google Finance

Referências · 7

• https://twitter.com/VulmonFeeds/status/2009679880791765272 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/top-position-google-finance/trunk/top-position-google-finance.php#L56 · Nota
• https://plugins.trac.wordpress.org/browser/top-position-google-finance/trunk/top-position-google-finance.php#L78 · Nota
• https://t.me/CVEtracker/41809 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009563542563824092 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/fcbf81f8-8b33-4b83-91fb-626b7b5f3bb2?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13895 · Nota de Segurança