CVE-2025-5753: 
WordPress vulnerability analysis and mitigation

The Valuation Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 1.3.2. The vulnerability was discovered and disclosed on July 22, 2025, and affects the WordPress plugin 'commercial-real-estate-valuation-calculator'. The issue stems from insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has been assigned a CVSS v3.1 base score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability exists in the plugin's handling of the 'link' parameter, where insufficient input sanitization and output escaping allow for the injection of malicious scripts (NVD, Wordfence).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page, potentially leading to unauthorized data access or manipulation of user interactions (NVD).

The plugin has been temporarily closed as of July 21, 2025, pending a full security review. Users are advised to disable and remove the plugin until a patched version becomes available (WordPress Plugin).