Stored Cross-Site Scripting in Ultra Skype Button Plugin for WordPress

CVE-2025-13898

What is CVE-2025-13898?

The Ultra Skype Button plugin for WordPress harbors a vulnerability that allows authenticated attackers with Contributor-level access and above to exploit the 'btn_id' parameter of the [ultra_skype] shortcode. This flaw results from inadequate input sanitization and output escaping, enabling adversaries to inject arbitrary web scripts into pages. These scripts execute when users access the compromised pages, potentially leading to unauthorized actions or data exposure. Website administrators are urged to review and mitigate this vulnerability to safeguard their platforms.

References