Stored Cross-Site Scripting in Any News Ticker Plugin for WordPress

CVE-2025-10168

What is CVE-2025-10168?

The Any News Ticker plugin for WordPress contains a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output escaping on the 'any-ticker' shortcode. This flaw allows attackers with contributor-level access and higher to embed malicious scripts into web pages. When a user visits the manipulated pages, the injected scripts will execute, potentially compromising sensitive data and the integrity of the site. It is crucial for site administrators to immediately assess their installations and implement necessary patches or mitigations to secure their websites.

References