CVE-2019-25315

MEDIUM 5.1 CVSS 4.0

Published: February 11, 2026
Last modified: June 17, 2026
NVD status: Deferred
Reported by: disclosure@vulncheck.com
Weakness: CWE-79
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.

Affected products and versions

anttiviljami WP Server Log Viewer — Version 1.0

References

github.com https://github.com/anttiviljami/wp-server-log-viewer
www.exploit-db.com https://www.exploit-db.com/exploits/47419
www.vulncheck.com https://www.vulncheck.com/advisories/wp-server-log-viewer-logfile-persistent-cross-site-scripting
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References