CVE-2025-58970

MediumCVSS 6.3

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

The Doctreat plugin up to version 1.6.7 has a basic XSS vulnerability (improper neutralization of script-related HTML tags), allowing code injection.

Risk Assessment

The organization may face XSS attacks, potentially leading to user data theft or session hijacking.

Recommendation

Update the plugin to the latest version and implement input filtering mechanisms.

Other vulnerabilities in Doctreat

CVE-2026-39770Critical
Unauthenticated Arbitrary File Upload vulnerability in Doctreat versions up to 1.7.0. An attacker can upload malicious files without authentication.

Original NVD description (English source)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS