{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11922", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-17T17:46:01.192Z", "datePublished": "2025-11-01T01:47:41.819Z", "dateUpdated": "2026-04-08T17:35:02.971Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:35:02.971Z"}, "affected": [{"vendor": "j_3rk", "product": "Inactive Logout", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.5.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fde110ae-c559-4d45-91c0-a3dd5ff05c4d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/core/Controllers/AdminController.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/core/Controllers/Admin/StoreController.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/views/tabs/tpl-inactive-logout-advanced.php#L99"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3385001%40inactive-logout%2Ftrunk&old=3362978%40inactive-logout%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-10-27T05:27:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-31T13:27:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T15:48:09.437180Z", "id": "CVE-2025-11922", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T15:48:16.331Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T15:48:09.437180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T15:48:13.352Z"}}], "cna": {"title": "Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "j_3rk", "product": "Inactive Logout", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.5.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-27T05:27:25.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-31T13:27:51.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fde110ae-c559-4d45-91c0-a3dd5ff05c4d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/core/Controllers/AdminController.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/core/Controllers/Admin/StoreController.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/views/tabs/tpl-inactive-logout-advanced.php#L99"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3385001%40inactive-logout%2Ftrunk&old=3362978%40inactive-logout%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-01T01:47:43.161Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11922", "state": "PUBLISHED", "dateUpdated": "2025-11-03T15:48:16.331Z", "dateReserved": "2025-10-17T17:46:01.192Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T01:47:41.819Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-11922", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-01T02:15:33.207", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/core/Controllers/Admin/StoreController.php#L84"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/core/Controllers/AdminController.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/inactive-logout/trunk/views/tabs/tpl-inactive-logout-advanced.php#L99"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3385001%40inactive-logout%2Ftrunk&old=3362978%40inactive-logout%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fde110ae-c559-4d45-91c0-a3dd5ff05c4d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:59:16.178436+00:00", "value": {"mitigation_remediation": ["Upgrade the Inactive Logout plugin to the latest version (3.5.6 or later) which removes the vulnerable parameter handling.", "Restrict the ability of subscriber and lower roles to modify the 'ina_redirect_page_individual_user' setting, for example by removing the capability from those roles or by setting the value to a safe default via a custom filter.", "Conduct a review of all plugin configuration pages to ensure that no unvalidated input is stored, and if necessary implement an additional sanitization routine or whitelist of allowed characters on the redirect field."], "summary": {"action": "Patch Update", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress plugin Inactive Logout (j_3rk:Inactive Logout) and any older releases \u2013 all versions up to and including 3.5.5. The issue is specific to that plugin only, and no other WordPress components are affected in the CVE scope.", "description_and_impact": "The vulnerable plugin accepts an unescaped redirect parameter that can be stored and later rendered in the browser. An attacker with subscriber\u2011level or higher privileges can inject scripts into the site\u2019s stored data. When a site visitor loads the affected page, the malicious code runs in the visitor\u2019s browser, potentially stealing session cookies or performing other actions under the visitor\u2019s context.", "risk_and_exploitability": "The CVSS score of 6.4 classifies the flaw as medium severity, and the EPSS score of less than 1% indicates a very low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated with at least subscriber permissions to manipulate the redirect parameter, after which a stored cross\u2011site scripting attack can be delivered to any user who views the injected content. Even with the low probability, the medium severity and the compatibility with normal user access make this a relevant risk for sites that use this plugin."}}}}, "created": "2025-11-03T10:43:45.897056+00:00", "updated": "2026-04-21T02:00:12.332487+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}