CVE-2021-25012: Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-28 · updated 2026-06-17
Weakness: CWE-79

Description

The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues

Affected products

Pz-LinkCard: through 2.4.4.4

References

https://wpscan.com/vulnerability/b126d2fc-6cc7-4c18-b95e-d32c2effcc4f
https://wpscan.com/vulnerability/b126d2fc-6cc7-4c18-b95e-d32c2effcc4f

Get alerted when CVE-2021-25012 or the next vulnerability affects your stack