CVE-2025-28906: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in Thiago S.F. Skitter Slideshow WordPress plugin affecting versions through 2.5.2. The vulnerability was reported on February 22, 2025, and publicly disclosed on March 11, 2025. This security issue has been assigned CVE-2025-28906 and received a CVSS v3.1 base score of 5.9 (Medium) (Patchstack Database).

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It has been assessed with a CVSS v3.1 Vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, high privileges required, user interaction required, and low impacts on confidentiality, integrity, and availability (NVD).

The vulnerability allows stored XSS attacks, which could enable malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack Database).

The vulnerability requires administrator privileges to exploit, which significantly reduces its potential impact. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack Database).

As of the disclosure date, no official fix is available for this vulnerability. Given the low severity of the issue, virtual patching has been deemed unnecessary (Patchstack Database).