Cross-site Scripting Vulnerability in mcjh Button Shortcode Plugin by Marcus C. J. Hartmann
CVE-2025-22558

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Mcjh Button Shortcode
Vendor
CVE Published:
7 January 2025

What is CVE-2025-22558?

A vulnerability in the mcjh Button Shortcode plugin allows for Cross-site Scripting (XSS) attacks due to improper handling of input during web page generation. This security flaw affects versions from n/a up to 1.6.4, enabling attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access and data theft. Website administrators are strongly advised to update to the latest version to mitigate these risks.

Affected Version(s)

mcjh button shortcode <= 1.6.4

References

https://patchstack.com/database/wordpress/plugin/mcjh-but...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
JSON
.