Stored Cross-Site Scripting Vulnerability in VigLink SpotLight by ShortCode Plugin for WordPress

CVE-2025-13843

What is CVE-2025-13843?

The VigLink SpotLight by ShortCode plugin for WordPress has a vulnerability that allows stored cross-site scripting due to inadequate input sanitization and output escaping on user-input attributes. This loophole enables authenticated attackers with Contributor-level permissions and above to embed arbitrary scripts within pages. Once exploited, these scripts will execute every time a user accesses the compromised page, potentially leading to unauthorized actions or data exposure.

References