CVE-2025-58025
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Master Slider plugin contains a Stored XSS vulnerability in versions up to and including 3.11.0. An attacker can inject a malicious script that executes in the user's browser.
Risk Assessment
Risk of data theft, session hijacking, or malware distribution.
Recommendation
Update the Master Slider plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Master Slider
See all- CVE-2026-56014High
Reflected XSS vulnerability in the Master Slider WordPress plugin, versions up to 3.11.5. Improper input neutralization during page generation allows reflected XSS attacks.
- CVE-2026-48968Medium
The Averta Master Slider plugin in versions up to and including 3.10.8 contains an improper neutralization of input during web page generation vulnerability. This may lead to DOM-based cross-site scripting.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This issue affects Master Slider: from n/a through <= 3.11.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS