CVE-2025-69017
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Stored XSS vulnerability in RestroPress (WordPress plugin) allows an attacker to inject malicious script into the page, which executes in the user's browser. Affects versions up to and including 3.2.8.6.
Risk Assessment
An attacker can hijack user sessions, steal data, or modify page content, leading to integrity and confidentiality breaches.
Recommendation
Update RestroPress to the latest available version that includes the fix. Additionally, restrict content editing privileges to trusted users only.
Other vulnerabilities in RestroPress
See all- CVE-2026-85010Medium
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart. This allows unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
- CVE-2026-85009Medium
The RestroPress WordPress plugin through version 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS