Stored Cross-Site Scripting in CSS3 Buttons Plugin for WordPress

CVE-2025-13907

What is CVE-2025-13907?

The CSS3 Buttons plugin for WordPress exposes a vulnerability that allows authenticated users, including those with contributor-level access, to exploit insufficient input sanitization and output escaping. By injecting arbitrary web scripts into the 'button' shortcode, attackers can execute harmful scripts whenever a user accesses an affected page, potentially compromising user data and security.

References