CVE-2025-57979

MediumCVSS 5.9

Published: 22/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

Stored XSS vulnerability in AuthorSure plugin (up to 2.3) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.

Risk Assessment

Risk of data theft, session hijacking, or malicious code propagation in the WordPress environment.

Recommendation

Update the plugin to the latest version and apply proper input filtering and output escaping.

Other vulnerabilities in AuthorSure

CVE-2025-13134Medium
The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3. Missing nonce validation on the 'authorsure' page allows unauthenticated attackers to update settings and inject malicious scripts via a forged request if an admin clicks a link.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through <= 2.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS