Stored Cross-Site Scripting in TweetThis Shortcode Plugin for WordPress

CVE-2025-10136

What is CVE-2025-10136?

The TweetThis Shortcode plugin for WordPress has a vulnerability that exposes users to Stored Cross-Site Scripting attacks. This issue arises from inadequate input sanitization and output escaping related to the plugin's 'tweetthis' shortcode. It allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts within pages. Consequently, any user accessing an infected page could inadvertently execute malicious scripts, leading to potential data theft or site compromise.

References