Stored Cross-Site Scripting in OpenID Connect Generic Client Plugin for WordPress

CVE-2025-13730

What is CVE-2025-13730?

The OpenID Connect Generic Client plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping mechanisms. Attackers with Contributor-level permissions or above can exploit this flaw through the 'openid_connect_generic_auth_url' shortcode. This allows them to inject malicious scripts into web pages that will be executed when users access the affected page, potentially compromising sensitive information and user security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References