PT-2025-38691 · WordPress · Markup Markdown

Minseok Kim · CVE-2025-9540 · Published 2025-09-22 · Updated 2025-09-22

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Markup Markdown WordPress plugin versions prior to 3.20.10

Description The plugin allows links to contain JavaScript, potentially enabling users with contributor or higher roles to execute Stored Cross-Site Scripting attacks.

Recommendations Update the Markup Markdown WordPress plugin to version 3.20.10 or later.

Exploit

Fix

Related Identifiers

CVE-2025-9540

Affected Products

Markup Markdown

References · 3

• 🔥 https://wpscan.com/vulnerability/79e606df-50a0-4639-b2d9-4a77111fd729 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9540 · Security Note
• https://t.me/CVEtracker/33035 · Telegram Post