Stored Cross-Site Scripting in TweetThis Shortcode Plugin for WordPress

CVE-2025-10136

What is CVE-2025-10136?

The TweetThis Shortcode plugin for WordPress has a vulnerability that exposes users to Stored Cross-Site Scripting attacks. This issue arises from inadequate input sanitization and output escaping related to the plugin's 'tweetthis' shortcode. It allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts within pages. Consequently, any user accessing an infected page could inadvertently execute malicious scripts, leading to potential data theft or site compromise.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References