Is CVE-2025-15692 being exploited?

No public exploit is currently tracked.

How severe is CVE-2025-15692?

CVE-2025-15692 has a CVSS v3 severity of LOW (3.5).

Back

CVE-2025-15692

Description

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.