CVE-2025-15692 — Icegram Express < 5.8.6 - Admin+ Stored XSS

CVE-2025-15692

Icegram Express < 5.8.6 - Admin+ Stored XSS PUBLISHED

Description (CNA)

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / Icegram Express	affected 0 before 5.8.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/263e7dc0-61bb-468e-9e15-a6b6789923f4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.