CVE-2025-3749: 
WordPress vulnerability analysis and mitigation

The Breeze Display plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-3749) discovered in versions up to and including 1.2.3. The vulnerability was disclosed on April 24, 2025, and affects the 'cal_size' parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 6.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L), no user interaction (UI:N), and affecting changed scope (S:C) with low confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N) (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability has been patched in version 1.2.4 of the Breeze Display plugin. The fix includes proper input sanitization and output escaping for the affected parameter. Users are advised to update to the latest version immediately (WordPress Plugin, Plugin Changes).