PT-2026-1722 · WordPress · Top Position Google Finance

Abdulsamad Yusuf · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-13895

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Top Position Google Finance versions up to and including 0.1.0

Description The Top Position Google Finance plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which can execute if a user is tricked into performing an action, such as clicking a link. The vulnerability is related to the $ SERVER['PHP SELF'] variable.

Recommendations Update Top Position Google Finance to a version newer than 0.1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13895

Affected Products

Top Position Google Finance

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13895 · Security Note
• https://twitter.com/VulmonFeeds/status/2009679880791765272 · Twitter Post
• https://plugins.trac.wordpress.org/browser/top-position-google-finance/trunk/top-position-google-finance.php#L56 · Note
• https://plugins.trac.wordpress.org/browser/top-position-google-finance/trunk/top-position-google-finance.php#L78 · Note
• https://t.me/CVEtracker/41809 · Telegram Post
• https://twitter.com/CVEnew/status/2009563542563824092 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fcbf81f8-8b33-4b83-91fb-626b7b5f3bb2?source=cve · Note