Stored Cross-Site Scripting in List Attachments Shortcode Plugin for WordPress

CVE-2025-12717

What is CVE-2025-12717?

The List Attachments Shortcode plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This flaw affects all versions up to and including 0.4.1a. It allows authenticated attackers, with Author-level access or higher, to inject arbitrary web scripts via the 'before_list' parameter in the [list-attachments] shortcode. Consequently, these scripts can execute whenever users access compromised pages, potentially leading to data theft and further exploitation.

References