CVE-2025-53330 MEDIUM

CVE-2025-53330: WordPress WP Rentals theme <= 3.16.1 - Cross Site Scripting (XSS) vulnerability

Vendor Wpestate

Product WP Rentals

Weakness CWE-79 · XSS

Published August 14, 2025

Last update May 12, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate WP Rentals wprentals allows Stored XSS.This issue affects WP Rentals: from n/a through <= 3.16.1.

Key dates

02Disclosure timeline

August 14, 2025 CVE published

May 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-53330

Related vulnerabilities

04Related CVE

CVE-2024-0585 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl CVE-2021-3950 Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk CVE-2023-32800 WordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS) CVE-2023-28789 WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS) CVE-2025-64609 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)