Arbitrary Shortcode Execution Vulnerability in So-Called Air Quotes Plugin for WordPress

CVE-2025-2803

What is CVE-2025-2803?

The So-Called Air Quotes plugin for WordPress is susceptible to a vulnerability that allows for arbitrary shortcode execution. This flaw arises from the plugin's lack of adequate input validation when processing actions. As a result, unauthenticated attackers may exploit this weakness to execute their own shortcodes, potentially leading to unauthorized actions on the website. Users should ensure they are utilizing the latest versions of the plugin and remain vigilant against such vulnerabilities.

References