Stored Cross-Site Scripting in BUKAZU Search Widget Plugin for WordPress

CVE-2025-13840

What is CVE-2025-13840?

The BUKAZU Search widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'shortcode' parameter in the 'bukazu_search' shortcode. This vulnerability arises from inadequate input sanitization and output escaping, which allows authenticated attackers with Contributor-level access or higher to inject arbitrary scripts. These scripts will execute when users access affected pages, posing significant security risks.

References