CVE-2025-62963
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Estatik plugin for WordPress (versions up to and including 4.3.1) is vulnerable to DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This may allow execution of malicious script in the user's browser.
Risk Assessment
An attacker could execute arbitrary JavaScript in the victim's browser context, potentially leading to session or data theft. The risk affects users visiting pages with the vulnerable plugin.
Recommendation
Update the Estatik plugin to the latest version (above 4.3.1). If update is not possible, consider disabling the plugin.
Other vulnerabilities in Estatik
See all- CVE-2026-96345High
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
- CVE-2026-96350Critical
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
- CVE-2026-81775High
Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS