CVE-2025-60141

MediumCVSS 5.9

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

The Tribal plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.3.3.

Risk Assessment

An attacker can inject a malicious script that executes in the browser of an administrator or other users, potentially leading to account takeover.

Recommendation

Update the Tribal plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in The Tribal

CVE-2026-39709Medium
The Tribal WordPress plugin inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 1.3.4.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal the-tech-tribe allows Stored XSS.This issue affects The Tribal: from n/a through <= 1.3.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS