PT-2025-4564 · Marcus Downing · Site Pin

João Pedro S Alcântara · Published 2025-01-13 · Updated 2025-01-13 · CVE-2025-22576

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The vulnerable software is Marcus Downing Site PIN, with versions from n/a through 1.3 being affected. The vulnerability is an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This type of vulnerability can be exploited by attackers to inject malicious scripts into web pages, potentially affecting users who visit the compromised site. There is a public reference to this issue, but no information is provided about whether it has been exploited by attackers or the number of Internet users who can be affected. The vulnerability can be exploited through reflected XSS attacks, where an attacker injects malicious code into a website, which is then reflected back to the user's browser, executing the malicious script. https://t.co/asBoZvJQ7h and https://t.co/GUlh6IwWFP provide more information about this issue. #MarcusDowningSitePIN #CrossSiteScripting #XSS #ReflectedXSS #CVE202522576 #ImproperNeutralizationOfInput #WebPageGeneration #SitePIN #Vulnerability

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22576

Affected Products

Site Pin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-22576 · Security Note
• https://patchstack.com/database/wordpress/plugin/site-pin/vulnerability/wordpress-site-pin-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/15137 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1878862812782408041 · Twitter Post
• https://twitter.com/CVEnew/status/1878799447410319859 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/site-pin/vulnerability/wordpress-site-pin-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note