Medium · 6.5 CVE-2025-27320 EUVD-2025-4335GHSA-mwr3-8q5m-r388

WordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerability

Published Feb 24, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Pankaj Mondal Product: Profile Widget Ninja

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through <= 4.3.

Affected products

Vendor	Product	Affected	Fixed
Pankaj Mondal	Profile Widget Ninja	≤ 4.3	—

References

https://patchstack.com/database/Wordpress/Plugin/profile-widget-ninja/vulnerability/wordpress-profile-widget-ninja-plugin-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry