PT-2025-46259 · WordPress · Precise Columns

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11869

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Precise Columns versions prior to 1.1

Description The Precise Columns plugin for WordPress is susceptible to Stored Cross-Site Scripting through the wrap id shortcode attribute. The plugin does not properly sanitize user input or escape output when inserting the wrapper ID into the generated HTML. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update Precise Columns to version 1.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11869

Affected Products

Precise Columns

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-11869 · Security Note
• https://plugins.trac.wordpress.org/browser/precise-columns/tags/1.0/precise-columns.php#L522 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/909afec0-7ff5-430d-814d-d75fcfcd6232?source=cve · Note
• https://twitter.com/CVEnew/status/1988095313274360093 · Twitter Post