PT-2026-8060 · WordPress · Link Hopper

Zast.Ai · Published 2026-02-14 · Updated 2026-02-14 · CVE-2025-15483

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Link Hopper plugin for WordPress versions up to and including 2.5

Description The Link Hopper plugin for WordPress is susceptible to Stored Cross-Site Scripting through the hop name parameter. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update the Link Hopper plugin to a version newer than 2.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15483

Affected Products

Link Hopper

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15483 · Security Note
• https://t.me/cveNotify/152026 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c6c52046-c85d-46af-b36c-41c70dad5426?source=cve · Note
• https://twitter.com/CVEnew/status/2022567892940906767 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2022719616284299648 · Twitter Post
• https://twitter.com/CVEarity/status/2022687743344808340 · Twitter Post
• https://plugins.trac.wordpress.org/browser/link-hopper/trunk/linkhopper.php#L205 · Note