{"affected":[{"defaultStatus":"unaffected","product":"Easy Social Icons","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.0.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2025-15701","cwes":["CWE-79"],"description":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"}],"kev":null,"metrics":[],"modifiedAt":1793858427863,"publishedAt":1793858427863,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/32a2349b-515e-4616-ab53-a7a536ade5a7/"}],"remediation":[],"revision":"a719469c66037e23dbca5a0a9ac7056ec1f9e4d4276b63d25dea4de1b66c6dcd","sources":[{"modifiedAt":1793858427863,"name":"CNA: WPScan","retrievedAt":1793858899303,"url":"https://www.cve.org/CVERecord?id=CVE-2025-15701"}],"ssvc":null,"status":"published","title":"Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings","updatedAt":1793858899303}