CVE-2025-58260

MediumCVSS 6.5

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Highlight and Share plugin up to version 5.1.1 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.

Risk Assessment

Attackers can inject malicious scripts, potentially leading to data theft, session hijacking, or malware distribution.

Recommendation

Update the Highlight and Share plugin to the latest patched version. Restrict user permissions and regularly scan content for malicious code.

Other vulnerabilities in Highlight and Share

CVE-2025-67586Medium
Missing Authorization vulnerability in Highlight and Share plugin (up to 5.2.0) by Ronald Huereca allows exploiting incorrectly configured access control security levels.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Stored XSS.This issue affects Highlight and Share: from n/a through <= 5.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS