CVE-2021-25026

5.5 mediumEPSS 0.7%

Medium (5.5) in patreon patreon wordpress. EPSS 0.7% chance of exploitation in the next 30 days.

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-03-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

patreon:patreon_wordpress

References

https://plugins.trac.wordpress.org/changeset/2682069
https://wpscan.com/vulnerability/02756dd3-832a-4846-b9e1-a34f148b5cfe
https://plugins.trac.wordpress.org/changeset/2682069
https://wpscan.com/vulnerability/02756dd3-832a-4846-b9e1-a34f148b5cfe

Check your stack JSON