vulnwire
5.5med

CVE-2025-5083

Amministrazione Trasparente <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print_r Function

Published 14 mo ago · modified 21 d ago · JSON

CVSS
5.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 19%
Public exploits
0
none known

The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
14 mo ago

Exploit prediction (EPSS)

0.27% probability of exploitation in the next 30 days, higher than 19% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.15.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CNA3.15.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Affected products

  • milmor Amministrazione Trasparente

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • wordfence.com /threat-intel/vulnerabilities/id/8741bbdf-ddd9-41f7-8d22-b9350f2cf659?source=cve
  • github.com /WPGov/amministrazione-trasparente/blob/31e69c2ef42f36bca0b66d0550794d18292f5a23/settings.
  • github.com /WPGov/amministrazione-trasparente/blob/31e69c2ef42f36bca0b66d0550794d18292f5a23/settings.
  • wordpress.org /plugins/amministrazione-trasparente/#developers
  • plugins.trac.wordpress.org /changeset/3352443/

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.