PT-2025-43221 · Leadbi · Leadbi Plugin For Wordpress

Mika · CVE-2025-49960 · Published 2025-10-22 · Updated 2025-11-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LeadBI Plugin for WordPress versions through 1.7

Description The LeadBI Plugin for WordPress contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be injected into web pages viewed by other users. The vulnerability allows an attacker to inject malicious code that will be executed in the context of a user’s browser.

Recommendations Update the LeadBI Plugin for WordPress to a version newer than 1.7.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49960

Affected Products

Leadbi Plugin For Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-49960 · Security Note
• https://twitter.com/CVEnew/status/1990791994193686630 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/leadbi/vulnerability/wordpress-leadbi-plugin-for-wordpress-plugin-1-7-cross-site-scripting-xss-vulnerability · Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/leadbi/vulnerability/wordpress-leadbi-plugin-for-wordpress-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/leadbi/vulnerability/wordpress-leadbi-plugin-for-wordpress-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Note