PT-2025-54305 · Unknown · Ruhul Amin Content Fetcher

Jitlada · Published 2025-12-31 · Updated 2026-01-01 · CVE-2025-49358

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ruhul Amin Content Fetcher versions through 1.1

Description The Ruhul Amin Content Fetcher software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-Site Scripting (XSS) issue. This allows for the potential execution of malicious scripts within the application. The vulnerability exists due to insufficient sanitization of user-supplied input before it is incorporated into the web page's Document Object Model (DOM). This could allow an attacker to inject arbitrary HTML or JavaScript code into the page, which would then be executed by the victim's browser. The affected API endpoints and vulnerable parameters were not specified.

Recommendations Update Ruhul Amin Content Fetcher to a version beyond 1.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49358

Affected Products

Ruhul Amin Content Fetcher

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-49358 · Security Note
• https://patchstack.com/database/wordpress/plugin/content-fetcher/vulnerability/wordpress-content-fetcher-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cveNotify/147310 · Telegram Post
• https://t.me/CVEtracker/41073 · Telegram Post
• https://twitter.com/CVEnew/status/2006736858441724354 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/content-fetcher/vulnerability/wordpress-content-fetcher-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/wordpress/plugin/content-fetcher/vulnerability/wordpress-content-fetcher-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note