PT-2025-5462 · WordPress · Orbisius Simple Notice

Pham Van Tam · Published 2025-01-24 · Updated 2025-01-24 · CVE-2025-24634

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Orbisius Simple Notice versions 1.1.3 and earlier

Description The issue affects the Orbisius Simple Notice plugin, allowing Stored XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting attacks.

Recommendations For Orbisius Simple Notice versions 1.1.3 and earlier, update to a version that contains a fix for this issue, as the current version is affected by the Stored XSS vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24634

Affected Products

Orbisius Simple Notice

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-24634 · Security Note
• https://twitter.com/CVEnew/status/1882903017344958784 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/orbisius-simple-notice/vulnerability/wordpress-orbisius-simple-notice-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/orbisius-simple-notice/vulnerability/wordpress-orbisius-simple-notice-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note