Stored Cross-Site Scripting in Easy Jump Links Menus Plugin for WordPress

CVE-2025-13860

What is CVE-2025-13860?

The Easy Jump Links Menus plugin for WordPress is affected by a vulnerability that allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts via the h_tags parameter. Due to inadequate input sanitization and output escaping mechanisms in versions up to and including 1.0.0, any injected scripts will execute when users visit the compromised page, potentially leading to unauthorized actions and data exposure.

References