Every CVE Search/ Get API key

CVE-2025-58266

WordPress Gianism plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerability

5.9 MediumFix available

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.22%Up 0.2 points since Sep 23, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.9

WordPress Gianism plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.

Record
CVE-2025-58266
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-30590 5.9

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.

Record
EUVD-2025-30590
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-37q7-p6vr-5j9p 5.9

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism allows Stored XSS. This issue affects Gianism: from n/a through 5.2.2.

Record
GHSA-37q7-p6vr-5j9p
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
NVD 5.9

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fumiki Takahashi Gianism gianism allows Stored XSS.This issue affects Gianism: from n/a through <= 6.0.0.

Record
CVE-2025-58266
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVopenSUSE-SU-2025:15426-1 No score

keylime-ima-policy-0.2.7+141-1.1 on GA media

These are all security issues fixed in the keylime-ima-policy-0.2.7+141-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15426-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20364-1 No score

Security update for rust-keylime

This update for rust-keylime fixes the following issues:

  • Update to version 0.2.8+116:
  • CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)
Record
openSUSE-SU-2026:20364-1
Updated
2026-11-02
Show 4 moreShow less
OSVSUSE-SU-2025:02809-1 No score

Security update for rust-keylime

This update for rust-keylime fixes the following issues:

  • Update to version 0.2.7+141:

    • CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)

  • Update to version 0.2.7+117:

    • CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).
    • CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).
    • CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).
    • CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).
    • CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).
    • rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)
Record
SUSE-SU-2025:02809-1
Updated
2026-11-02
OSVSUSE-SU-2025:02810-1 No score

Security update for rust-keylime

This update for rust-keylime fixes the following issues:

  • Update to version 0.2.7+141:

    • CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)

  • Update to version 0.2.7+117:

    • CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).
    • CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).
    • CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).
    • CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).
    • CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).
    • rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)
Record
SUSE-SU-2025:02810-1
Updated
2026-11-02
OSVSUSE-SU-2025:02811-1 No score

Security update for rust-keylime

This update for rust-keylime fixes the following issues:

  • Update to version 0.2.7+141:

    • CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)

  • Update to version 0.2.7+117:

    • CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).
    • CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).
    • CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).
    • CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).
    • CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).
    • rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)
Record
SUSE-SU-2025:02811-1
Updated
2026-11-02
OSVSUSE-SU-2026:20744-1 No score

Security update for rust-keylime

This update for rust-keylime fixes the following issues:

  • Update to version 0.2.8+116:
  • CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)
Record
SUSE-SU-2026:20744-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rust-keylime
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 6 CVEs
 before 0.2.7+141-150400.3.7.1
0.2.7+141-150400.3.7.1
rust-keylime
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 6 CVEs
 before 0.2.7+141-150400.3.5.1
0.2.7+141-150400.3.5.1
rust-keylime
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 6 CVEs
 before 0.2.7+141-150500.3.5.1
0.2.7+141-150500.3.5.1
rust-keylime
SUSE:Linux Micro 6.2
From an advisory covering 3 CVEs
 before 0.2.8+116-160000.1.1
0.2.8+116-160000.1.1
rust-keylime
openSUSE:Tumbleweed
 before 0.2.7+141-1.1
0.2.7+141-1.1
rust-keylime
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 0.2.8+116-160000.1.1
0.2.8+116-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-58266 is a medium vulnerability (CVSS 5.9) in Fumiki Takahashi Gianism, published August 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in rust-keylime 0.2.7+141-1.1.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open