Stored Cross-Site Scripting in BUKAZU Search Widget Plugin for WordPress

CVE-2025-13840

What is CVE-2025-13840?

The BUKAZU Search widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'shortcode' parameter in the 'bukazu_search' shortcode. This vulnerability arises from inadequate input sanitization and output escaping, which allows authenticated attackers with Contributor-level access or higher to inject arbitrary scripts. These scripts will execute when users access affected pages, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References