CVE-2025-58830

MediumCVSS 6.5

Published: 05/09/2025(UTC)Updated: 05/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The WordPress plugin Parallax Scrolling Enllax.js up to version 0.0.6 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

Risk Assessment

The risk includes session hijacking, data theft, or spreading malicious code within the WordPress admin panel.

Recommendation

Update the Parallax Scrolling Enllax.js plugin to the latest available version that includes a security fix.

Other vulnerabilities in Parallax Scrolling Enllax.js

CVE-2025-58831Medium
The Parallax Scrolling Enllax.js plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.6. This vulnerability allows unauthenticated attackers to perform unwanted actions in the context of an administrator.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Stored XSS.This issue affects Parallax Scrolling Enllax.js: from n/a through <= 0.0.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS