Stored Cross-Site Scripting in Divelogs Widget Plugin for WordPress

CVE-2025-13962

What is CVE-2025-13962?

The Divelogs Widget for WordPress is exposed to vulnerabilities due to inadequate input sanitization and output escaping for the 'latestdive' shortcode. This risk allows authenticated users with contributor-level access or higher to inject harmful scripts into pages, which execute when other users view the compromised content. Affected versions include all up to and including 1.5, necessitating immediate attention for updates and patches to mitigate potential exploitation.

References