CVE-2025-15690
Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.
| Vendor | unknown |
| Product | content mask |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown content mask
Be the first to know when new medium vulnerabilities affecting unknown content mask are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Content Mask
1.7.1 < 1.8.5.6
References
Credits
Andrea Fiocchi WPScan