CVE detail
CVE-2025-5085
The WP Nano AD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘blogrole_link’ parameter in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
5 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026)Wordfence
6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-8206 Patch Status Patched Published Jun 1, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher CHOIGYEONGMIN More Details > Multiple ShapedPlugin Plugins Support Board Gravit
vendorwww.wordfence.comJun 11, 2026, 5:13 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/350c23c6-6201-4dd5-9594-edb7d8ad926c?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comJun 2, 2026, 9:16 AM - https://plugins.trac.wordpress.org/browser/wp-nano-ad/trunk/add_links.phpplugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 2, 2026, 9:16 AM No excerpt available.
Exploitgithub.comJun 2, 2026, 9:16 AM- https://cor.wordpress.org/plugins/wp-nano-ad/cor.wordpress.org
No excerpt available.
referencecor.wordpress.orgJun 2, 2026, 9:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-65448CVSS 6.5 · Medium
Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.
- CVE-2026-65447CVSS 7.1 · High
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
- CVE-2026-65446CVSS 7.1 · High
Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
- CVE-2026-65443CVSS 7.1 · High
Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
- CVE-2026-65441CVSS 7.1 · High
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
- CVE-2026-65440CVSS 7.1 · High
Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.