Stored Cross-Site Scripting Vulnerability in Qzzr Shortcode Plugin for WordPress

CVE-2025-11806

What is CVE-2025-11806?

The Qzzr Shortcode Plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) issue due to inadequate input sanitization and output escaping in the 'quiz' attribute of the 'qzzr' shortcode. This vulnerability allows authenticated attackers with contributor-level access and higher to inject arbitrary JavaScript code into web pages. The injected scripts can execute whenever a user accesses the compromised page, leading to potential unauthorized actions and exposure of sensitive user information.

References