5.9Medium

CVE-2025-28936WordPress Lunar plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

sakurapixel Lunar Published: 2025-03-12 00:01 (1 year ago)

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sakurapixel Lunar lunar-sell-photos-online allows Stored XSS.This issue affects Lunar: from n/a through <= 1.3.0.

Weakness (CWE): CWE-79

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
sakurapixel	Lunar	≤ 1.3.0

References and patches

https://patchstack.com/database/Wordpress/Plugin/lunar-sell-photos-online/vulnerability/wordpress-lunar-plugi… vdb-entry

CVSS score

5.9Medium

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

All scores (2)

cna	CVSS 3.1	5.9Medium
audit@patchstack.com	CVSS 3.1	5.9Medium

EPSS (chance of exploitation in 30 days)

0.29%

higher than 21% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-03-11
Published2025-03-12 00:01
Reached IP-DB2026-10-25 00:02
Last updated2026-06-17 12:04

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

Unscored

CVE-2026-124822 3 hours ago

Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

Easy DragDrop File Uploader

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Unscored

CVE-2026-124833 3 hours ago

Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

Ahime Image Printer

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

Unscored

CVE-2026-125711 3 hours ago

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Widgets for Google Reviews; WP Tripadvisor Review Widgets; Widgets for Booking.com Reviews; Widgets for Reviews & Recommendations

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …

Unscored

CVE-2026-125912 3 hours ago

WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbit…

Unscored

CVE-2026-126119 3 hours ago

Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call

Streamit

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated …

Unscored

CVE-2026-123097 3 hours ago

WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

WP Remote Users Sync

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any ex…