CVE-2025-58027

MediumCVSS 6.5

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The NGG Smart Image Search plugin contains a Stored XSS vulnerability in versions up to and including 3.4.3. An attacker can inject a malicious script that executes in the user's browser.

Risk Assessment

Risk of data theft, session hijacking, or malware distribution.

Recommendation

Update the NGG Smart Image Search plugin to the latest version that fixes this vulnerability.

Other vulnerabilities in NGG Smart Image Search

CVE-2026-73185Critical
SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS