Stored Cross-Site Scripting Vulnerability in ST Categories Widget for WordPress

CVE-2025-11878

What is CVE-2025-11878?

The ST Categories Widget plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack due to inadequate input sanitization and output escaping of user-supplied attributes within its st-categories shortcode. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. Upon access, these scripts can be executed in the context of other users, potentially compromising their security and privacy.

References