Medium severity · published Sep 9, 2026
CVE-2025-15690
Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page.
The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Content Mask ·
1.7.1 before 1.8.5.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15690
wpscan.com
https://wpscan.com/vulnerability/bb49823c-16f1-4cce-a212-ae2aa7ea5730/
More from Content Mask
2.7
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask