Medium · 6.5 CVE-2025-62744 EUVD-2025-205974GHSA-wq29-jhr9-4whp

WordPress Page Title Splitter plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Published Dec 31, 2025 · Updated May 12, 2026 · Assigned by Patchstack

Vendor: Chris Steman Product: Page Title Splitter

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Steman Page Title Splitter page-title-splitter allows Stored XSS.This issue affects Page Title Splitter: from n/a through <= 2.5.9.

Affected products

Vendor	Product	Affected	Fixed
Chris Steman	Page Title Splitter	≤ 2.5.9	—

References

https://patchstack.com/database/Wordpress/Plugin/page-title-splitter/vulnerability/wordpress-page-title-splitter-plugin-2-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry