PT-2025-13405 · Unknown · Mainwp Dashboard

Published 2025-03-27 · Updated 2025-03-29 · CVE-2025-28253

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MainWP MainWP Dashboard version 5.3.4

Description A Cross-Site Scripting (XSS) issue exists in the MainWP MainWP Dashboard, specifically in the class/class-mainwp-post-handler.php file. The problem arises from unsanitized user input from $ POST['sites'], $ POST['clients'], and $ POST['search'] being passed into the MainWP User::render table function. Despite the use of sanitize text field and wp unslash, the values are not adequately protected against HTML or script injection, allowing an attacker to inject malicious scripts.

Recommendations For MainWP MainWP Dashboard version 5.3.4, consider disabling the MainWP User::render table function or restricting the use of the class/class-mainwp-post-handler.php file until a patch is available. Additionally, avoid using the parameters $ POST['sites'], $ POST['clients'], and $ POST['search'] in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-28253

Affected Products

Mainwp Dashboard

References · 7

• 🔥 https://github.com/edwin-0990/CVE_ID/tree/main/CVE-2025-28253 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28253 · Security Note
• https://t.me/cvetracker/20115 · Telegram Post
• https://t.me/cvedetector/21347 · Telegram Post
• https://twitter.com/CVEnew/status/1906038474542928190 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1905446794961576403 · Twitter Post
• https://t.me/cvenotify/116642 · Telegram Post