Stored Cross-Site Scripting in e.nigma buttons Plugin for WordPress

CVE-2025-5535

What is CVE-2025-5535?

The e.nigma buttons plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the plugin's 'button' shortcode in all versions up to and including 1.1.3. Due to inadequate input sanitization and insufficient output escaping of user-supplied attributes, this flaw enables authenticated attackers with contributor-level access and above to inject malicious web scripts into web pages. These scripts will execute whenever users visit the compromised pages, potentially leading to unauthorized actions and data exposure.

References