Stored Cross-Site Scripting Vulnerability in VigLink SpotLight by ShortCode Plugin for WordPress

CVE-2025-13843

What is CVE-2025-13843?

The VigLink SpotLight by ShortCode plugin for WordPress has a vulnerability that allows stored cross-site scripting due to inadequate input sanitization and output escaping on user-input attributes. This loophole enables authenticated attackers with Contributor-level permissions and above to embed arbitrary scripts within pages. Once exploited, these scripts will execute every time a user accesses the compromised page, potentially leading to unauthorized actions or data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References