CVE-2025-63048

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The ListingPro Lead Form plugin (versions up to and including 1.0.7) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.

Risk Assessment

An attacker could exploit the vulnerability to execute a malicious script in the user's browser, potentially leading to session theft or account takeover. The risk is particularly relevant for administrators visiting affected pages.

Recommendation

Update the ListingPro Lead Form plugin to a version newer than 1.0.7 once a fix is available. Until then, avoid visiting untrusted sites using this plugin.

Other vulnerabilities in ListingPro Lead Form

CVE-2025-63049Medium
The ListingPro Lead Form plugin by CridioStudio is vulnerable to Missing Authorization, allowing access to functionality not properly constrained by ACLs. This issue affects ListingPro Lead Form from n/a through <= 1.0.7.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS