Skip to content
OpenAdvisories
High · 7.1 CVE-2025-53286 EUVD-2025-37996GHSA-whm5-j2cq-jjh4

WordPress Dropify plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability

Published Nov 6, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhainey Milevis Dropify wc-dropi-integration allows Reflected XSS.This issue affects Dropify: from n/a through <= 4.7.2.

Affected products

VendorProductAffectedFixed
Jhainey Milevis Dropify ≤ 4.7.2 —

References