Stored Cross-Site Scripting Vulnerability in Hide It for WordPress

CVE-2025-5565

What is CVE-2025-5565?

The Hide It plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access and above to execute arbitrary web scripts through the plugin's 'hideit' shortcode. This is due to inadequate input sanitization and output escaping of user-supplied attributes. As a result, an attacker can inject malicious code into pages, which will be executed when other users visit the affected pages. It is crucial to update to the latest version to mitigate this risk.

References