Stored Cross-Site Scripting in OpenID Connect Generic Client Plugin for WordPress

CVE-2025-13730

What is CVE-2025-13730?

The OpenID Connect Generic Client plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping mechanisms. Attackers with Contributor-level permissions or above can exploit this flaw through the 'openid_connect_generic_auth_url' shortcode. This allows them to inject malicious scripts into web pages that will be executed when users access the affected page, potentially compromising sensitive information and user security.

References