CVE-2025-62051
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The UDesign Core plugin by AndonDesign contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects UDesign Core from n/a through <= 4.14.1.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, potentially leading to data theft or session hijacking.
Recommendation
Update the UDesign Core plugin to the latest version that includes security fixes. Additionally, apply the principle of least privilege and validate input data.
Other vulnerabilities in UDesign Core
See all- CVE-2026-42416High
The UDesign Core plugin in versions up to and including 4.15.0 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
- CVE-2025-53236Medium
The UDesign Core plugin by AndonDesign is vulnerable to Missing Authorization in versions from n/a through 4.14.0. This issue allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core.This issue affects UDesign Core: from n/a through <= 4.14.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS