Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2019-25743

CVE-2019-25743MEDIUM

Soliloquywp Soliloquy Lite — WordPress Soliloquy Lite 2.5.6 Persistent Cross-Site Scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   P   N   N   N    5.1   .0017    5.9     —

AFFECTED
  Product         Versions  Fixed
  Soliloquy Lite  2.5.6 –   —

TIMELINE
  Jun 4   Reserved by VulnCheck
  Jun 4   Published (CNA: VulnCheck)
  Oct 1   EXPLOIT PUBLISHED — CVE-2019-25743 (Soliloquywp Soliloquy Lite). Public exploit reference added.

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

Description

WordPress Soliloquy Lite 2.5.6 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting script tags in the post title field. Attackers can submit POST requests to the post editing endpoint with script payloads in the post_title parameter, which are stored and executed when users preview the post.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 4, 2026	Reserved	Reserved by VulnCheck
June 4, 2026	Published	Published (CNA: VulnCheck)
October 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2019-25743 (Soliloquywp Soliloquy Lite). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Soliloquywp	Soliloquy Lite	—	2.5.6	—

Weaknesses

CWE-79

References (4)

https://soliloquywp.com/ [product]
https://wordpress.org/plugins/soliloquy-lite/ [product]
https://www.exploit-db.com/exploits/47517 [exploit]
https://www.vulncheck.com/advisories/wordpress-soliloquy-lite-persistent-cross-site-scripting [third-party-advisory]

Authoritative record: CVE-2019-25743 at cve.org

Vendors: soliloquywp

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-25743 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.