CVE-2025-9989
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 1.53.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html is disabled.
Risk Assessment
An attacker with administrator privileges can inject malicious scripts that execute in other users' browsers, potentially leading to data theft, session hijacking, or other attacks.
Recommendation
Update the plugin to the latest version with the fix. Also restrict access to admin settings and enable appropriate security filters.
Other vulnerabilities in Broadstreet
See all- CVE-2025-9988Medium
The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create advertisers.
- CVE-2025-9987Medium
The Broadstreet plugin for WordPress in all versions up to and including 1.53.1 is vulnerable to Sensitive Information Exposure via the get_sponsored_meta() AJAX action. An authenticated attacker with subscriber-level access or higher can extract data from password-protected and private business details.
Original NVD description (English source)
The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS