Broadstreet WordPress plugin - Reflected XSS
CVE-2025-4652
Verified
Description
Broadstreet WordPress plugin < 1.51.8 contains a reflected XSS caused by unsanitised and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires victim interaction.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
broadstreet
Published Date
February 11, 2026
Template Author
sourabh-sahu
CVE-2025-4652.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2025-4652
CWE ID:
cwe-79
Remediation Steps
Update to version 1.51.8 or later.