Stored Cross-Site Scripting Vulnerability in WP-Recall Plugin for WordPress

CVE-2025-1324

What is CVE-2025-1324?

The WP-Recall plugin for WordPress is vulnerable to a stored cross-site scripting issue through its 'public-form' shortcode. This vulnerability stems from inadequate input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These malicious scripts can execute whenever a user accesses a compromised page, potentially compromising the security of the site and its users.

References