CVE-2025-15000

The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/page-keys/tags/1.3.3/inc/ListTable.php#L260
• https://plugins.trac.wordpress.org/browser/page-keys/trunk/inc/ListTable.php#L260
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3863ec-0cc7-4128-a19e-fc1e2c31195e?source=cve

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14995A vulnerability has been found in Tenda FH1201 1.2.0.14(408)…8.8
• CVE-2025-14996The AS Password Field In Default Registration Form plugin fo…9.8
• CVE-2025-14997The BuddyPress Xprofile Custom Field Types plugin for WordPr…8.8
• CVE-2025-14998The Branda plugin for WordPress is vulnerable to privilege e…9.8
• CVE-2025-14999The Latest Tabs plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-1500IBM Maximo Application Suite 9.0 could allow an authenticate…8
• CVE-2025-15001The FS Registration Password plugin for WordPress is vulnera…9.8
• CVE-2025-15002A vulnerability has been found in SeaCMS up to 13.3. The aff…9.8
• CVE-2025-15003A vulnerability was found in SeaCMS up to 13.3. The impacted…7.2
• CVE-2025-15004A vulnerability was identified in DedeCMS up to 5.7.118. Thi…8.8
• CVE-2025-15005A security flaw has been discovered in CouchCMS up to 2.4. A…3.7
• CVE-2025-15006A weakness has been identified in Tenda WH450 1.0.0.18. Affe…9.8