Stored Cross-Site Scripting in Markdown Shortcode Plugin for WordPress

CVE-2025-10180

What is CVE-2025-10180?

The Markdown Shortcode plugin for WordPress presents a vulnerability that allows stored cross-site scripting (XSS) through the plugin's 'markdown' shortcode. This issue arises from inadequate input sanitization and output escaping for user-supplied attributes. Authenticated attackers with contributor-level access and above can exploit this vulnerability to inject arbitrary web scripts into pages. The injected scripts will execute whenever a user visits an affected page, potentially compromising user data and affecting site integrity.

References