PT-2025-53811 · Sleekplan · Sleekplan

Mika · Published 2025-12-29 · Updated 2026-01-04 · CVE-2025-23469

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sleekplan versions through 0.2.0

Description A Reflected Cross-site Scripting (XSS) issue exists in Sleekplan due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts into web pages viewed by other users. The input provided is not properly sanitized, leading to the execution of arbitrary code within the context of the user's browser. The vulnerable component is related to web page generation.

Recommendations Update Sleekplan to a version later than 0.2.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23469

Affected Products

Sleekplan

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-23469 · Security Note
• https://twitter.com/CVEnew/status/2005809469926658511 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/sleekplan/vulnerability/wordpress-sleekplan-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/40894 · Telegram Post
• https://vdp.patchstack.com/database/wordpress/plugin/sleekplan/vulnerability/wordpress-sleekplan-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/sleekplan/vulnerability/wordpress-sleekplan-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/2007769013183795383 · Twitter Post