Arbitrary Shortcode Execution Vulnerability in So-Called Air Quotes Plugin for WordPress
CVE-2025-2803
7.3HIGH
What is CVE-2025-2803?
The So-Called Air Quotes plugin for WordPress is susceptible to a vulnerability that allows for arbitrary shortcode execution. This flaw arises from the plugin's lack of adequate input validation when processing actions. As a result, unauthenticated attackers may exploit this weakness to execute their own shortcodes, potentially leading to unauthorized actions on the website. Users should ensure they are utilizing the latest versions of the plugin and remain vigilant against such vulnerabilities.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
So-Called Air Quotes * <= 0.1
References
CVSS V3.1
Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Avraham Shemesh