{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3749", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-16T20:42:12.086Z", "datePublished": "2025-04-24T22:22:13.994Z", "dateUpdated": "2026-04-08T16:52:50.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:50.699Z"}, "affected": [{"vendor": "mgyura", "product": "Breeze Display", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018cal_size\u2019 parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/527dd2c7-5bbb-4c79-aa3c-7d70ddd26163?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wt-display-breeze/trunk/includes/shortcodes.php#L114"}, {"url": "https://wordpress.org/plugins/wt-display-breeze/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3280146/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-04-24T09:50:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-25T19:25:15.969453Z", "id": "CVE-2025-3749", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T19:25:31.349Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-25T19:25:15.969453Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T19:25:22.216Z"}}], "cna": {"title": "Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mgyura", "product": "Breeze Display", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-24T09:50:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/527dd2c7-5bbb-4c79-aa3c-7d70ddd26163?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wt-display-breeze/trunk/includes/shortcodes.php#L114"}, {"url": "https://wordpress.org/plugins/wt-display-breeze/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3280146/"}], "descriptions": [{"lang": "en", "value": "The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018cal_size\u2019 parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:50.699Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3749", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:50.699Z", "dateReserved": "2025-04-16T20:42:12.086Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-24T22:22:13.994Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018cal_size\u2019 parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Breeze Display para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'cal_size' en todas las versiones hasta la 1.2.3 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3749", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-04-24T23:15:15.200", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wt-display-breeze/trunk/includes/shortcodes.php#L114"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3280146/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wt-display-breeze/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/527dd2c7-5bbb-4c79-aa3c-7d70ddd26163?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:40:02.466361+00:00", "value": {"mitigation_remediation": ["Upgrade Breeze Display to a version newer than 1.2.3 to obtain the fixed code that validates and escapes the cal_size input.", "If an upgrade cannot be performed immediately, restrict contributor access or remove the cal_size parameter from shortcode usage to prevent payload injection.", "Implement a content security policy that blocks inline scripts to mitigate the effect of any stored payload that may have been injected."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress site using Breeze Display plugin version 1.2.3 or earlier is at risk. The vulnerability affects the plugin\u2019s shortcode implementation available to users with contributor role or higher.", "description_and_impact": "The Breeze Display WordPress plugin has a stored XSS vulnerability in the cal_size parameter that allows an authenticated attacker with contributor level or higher to inject script tags that will be served to all users who view the affected page. The flaw stems from insufficient input validation and missing output escaping.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate risk. The EPSS score of less than 1% suggests low exploitation likelihood and the vulnerability is not listed in CISA KEV. Exploitation involves submitting a malicious cal_size value via the shortcode editor; the script is stored and executed whenever any visitor loads the content page."}}}}, "created": "2025-07-13T21:06:54.870670+00:00", "updated": "2026-04-22T01:45:05.623549+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}