Stored Cross-Site Scripting in Precise Columns Plugin for WordPress

CVE-2025-11869

What is CVE-2025-11869?

The Precise Columns plugin for WordPress is susceptible to Stored Cross-Site Scripting due to improper sanitization of user input in the wrap_id shortcode attribute. This vulnerability affects all versions up to and including 1.0, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. These scripts can execute when users visit compromised pages, leading to potential data theft or site hijacking. It is crucial for site administrators to update the plugin and implement security measures to prevent exploitation.

References