Stored Cross-Site Scripting in WP Flot Plugin for WordPress

CVE-2025-13906

What is CVE-2025-13906?

The WP Flot plugin for WordPress suffers from a vulnerability that allows authenticated attackers, with contributor-level access or higher, to exploit insufficient input sanitization and output escaping in the plugin's 'linechart' shortcode. This flaw enables malicious users to inject arbitrary web scripts into pages, leading to potential unauthorized actions or data exposure when other users access such compromised pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References