CVE-2025-10145: 
WordPress Analyse et atténuation des vulnérabilités

The Hubbub Lite WordPress plugin versions before 1.34.4 contains a Stored Cross-Site Scripting (XSS) vulnerability that affects high-privilege users such as administrators. The vulnerability was discovered in 2024 and assigned CVE-2024-10145 (WPScan).

The vulnerability exists because the plugin does not properly sanitize and escape some of its settings in the Social Networks field within the Inline Content panel. This allows high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has a CVSS score of 3.5 (Low) (WPScan).

If exploited, this vulnerability allows authenticated users with administrative privileges to store and execute malicious JavaScript code on the affected WordPress site. This could potentially lead to client-side attacks against other administrative users who view the affected pages (WPScan).

The vulnerability has been patched in version 1.34.4 of the Hubbub Lite plugin. Site administrators should update to this version or later to mitigate the risk (WPScan).