Stored Cross-Site Scripting in WP Dropzone Plugin by WordPress

CVE-2025-13989

What is CVE-2025-13989?

The WP Dropzone plugin for WordPress allows for Stored Cross-Site Scripting (XSS) through the 'callback' shortcode attribute, affecting all versions up to and including 1.1.1. This vulnerability arises from a lack of proper input sanitization and output escaping for user-supplied 'callback' attributes. When these attributes are processed, they are evaluated as JavaScript code using the new Function() constructor. As a result, authenticated users with Contributor-level access and above may exploit this to inject malicious scripts into pages, leading to arbitrary script execution when those pages are accessed by other users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References