PT-2026-1489 · Posimyth · Posimyth Uichemy

Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-69362

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions POSIMYTH UiChemy versions through 4.4.2

Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This means malicious scripts can be stored on the target server and executed by other users when they view the affected web page. The vulnerability exists due to insufficient sanitization of user-supplied data before it is included in the generated web page. This could allow an attacker to inject arbitrary scripts into the web page, potentially leading to the compromise of user accounts or sensitive information.

Recommendations Update POSIMYTH UiChemy to a version later than 4.4.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-69362

Affected Products

Posimyth Uichemy

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-69362 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/uichemy/vulnerability/wordpress-uichemy-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/41515 · Telegram Post
• https://twitter.com/CVEnew/status/2008589644888256552 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/uichemy/vulnerability/wordpress-uichemy-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note