CVE-2025-67586

MediumCVSS 4.7

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

36th percentile - higher than 36% of all known CVEs

Summary

Missing Authorization vulnerability in Highlight and Share plugin (up to 5.2.0) by Ronald Huereca allows exploiting incorrectly configured access control security levels.

Risk Assessment

The risk includes potential unauthorized access to plugin functionality, leading to data confidentiality breaches or unauthorized content modifications.

Recommendation

Update the plugin to the latest version and review access control settings to ensure proper authorization.

Other vulnerabilities in Highlight and Share

CVE-2025-58260Medium
The Highlight and Share plugin up to version 5.1.1 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.

Original NVD description (English source)

Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS